CVE-2026-63951
Received Received - Intake

Race Condition in Linux Kernel zram Use-After-Free

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_writeback_endio A crash was observed in zram_writeback_endio due to a NULL pointer dereference in wake_up. The root cause is a race condition between the bio completion handler (zram_writeback_endio) and the writeback task. In zram_writeback_endio, wake_up() is called on &wb_ctl->done_wait after releasing wb_ctl->done_lock. This creates a race window where the writeback task can see num_inflight become 0, return, and free wb_ctl before zram_writeback_endio calls wake_up(). CPU 0 (zram_writeback_endio) CPU 1 (writeback_store) ============================ ============================ zram_writeback_slots zram_submit_wb_request zram_submit_wb_request wait_event(wb_ctl->done_wait) spin_lock(&wb_ctl->done_lock); list_add(&req->entry, &wb_ctl->done_reqs); spin_unlock(&wb_ctl->done_lock); wake_up(&wb_ctl->done_wait); zram_complete_done_reqs spin_lock(&wb_ctl->done_lock); list_add(&req->entry, &wb_ctl->done_reqs); spin_unlock(&wb_ctl->done_lock); while (num_inflight) > 0) spin_lock(&wb_ctl->done_lock); list_del(&req->entry); spin_unlock(&wb_ctl->done_lock); // num_inflight becomes 0 atomic_dec(num_inflight); // Leave zram_writeback_slots // Free wb_ctl release_wb_ctl(wb_ctl); // UAF crash! wake_up(&wb_ctl->done_wait); This patch fixes this race by using RCU. By protecting wb_ctl with rcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it, we ensure that wb_ctl remains valid during the execution of zram_writeback_endio.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63951
EUVD
EUVD-2026-45724

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's zram module. It occurs due to a race condition between the bio completion handler (zram_writeback_endio) and the writeback task. The crash happens when zram_writeback_endio tries to wake up a process after the wb_ctl structure has already been freed by the writeback task.

Detection Guidance

This vulnerability is specific to the Linux kernel's zram module and may not have direct network detection methods. Check kernel logs for crashes or NULL pointer dereference errors related to zram or writeback operations. Commands like dmesg | grep -i zram or journalctl -k | grep -i zram may help identify issues.

Impact Analysis

This vulnerability can cause system crashes due to NULL pointer dereferences. If exploited, it may lead to denial-of-service conditions, kernel panics, or potential privilege escalation if an attacker can trigger the race condition.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's zram module, which could lead to system crashes or instability. It does not directly impact data confidentiality or integrity but may cause denial-of-service conditions. Compliance with standards like GDPR or HIPAA typically focuses on data protection, access controls, and system availability. While this issue does not directly violate these standards, repeated crashes could indirectly affect system reliability and availability, potentially impacting compliance in environments where uptime is critical.

Mitigation Strategies

Apply the kernel patch that fixes the race condition in zram_writeback_endio. Update your Linux kernel to a version containing the fix. If immediate patching is not possible, consider disabling zram writeback functionality temporarily as a workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63951. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart