CVE-2026-89717

Received Received - Intake

zram NULL Pointer Dereference in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_destroy_comps() Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported [1] a couple of zram issues: a possible BUG_ON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing. This patch (of 2): zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set default primary compressor in zram_destroy_comps().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-21

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89717

EUVD

EUVD-2026-76629

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	zram	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's zram module. It occurs when zram_destroy_comps() resets all compressors to NULL, including the primary one. This leaves the device in an invalid state where comp_algorithm_show() may attempt to compare against a NULL compressor, potentially causing issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's zram module and does not have network-based detection methods. To check if your system is affected, verify the kernel version and zram configuration. Use commands like 'uname -r' to check the kernel version and 'lsmod | grep zram' to confirm zram is loaded. If the kernel version is below the patched version, the system may be vulnerable.

Impact Analysis

The impact is limited but could cause system instability if the zram module is used. A NULL pointer dereference or BUG_ON() in zlib code may occur, leading to crashes or unexpected behavior in systems relying on zram compression.

Compliance Impact

This vulnerability in the Linux kernel's zram component does not directly impact compliance with standards like GDPR or HIPAA. The issue involves a potential NULL-pointer dereference and missing winbits validation in zlib, which are low-risk kernel-level bugs. No evidence suggests these flaws affect data protection, encryption, or access control mechanisms required by such regulations.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-89717. If updating the kernel is not immediately possible, disable the zram module by running 'modprobe -r zram' and avoid using zram features until patched. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-89717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70