CVE-2026-89719

Received Received - Intake

zram Out-of-Bounds Access in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table. The subsequent loop can then call slot_lock() past the end of the newly allocated table. Read disksize after acquiring dev_lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-21

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89719

EUVD

EUVD-2026-76631

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's zram module. It involves an out-of-bounds access in the read_block_state() function. The issue occurs when the device is reset and reinitialized with a smaller size before a lock is acquired. The function calculates the number of pages based on the old size, leading to an attempt to access memory beyond the newly allocated table.

Detection Guidance

This vulnerability is specific to the Linux kernel's zram module and requires kernel-level inspection. There are no direct network detection commands. To check for potential exploitation or vulnerable conditions, inspect the kernel logs for zram-related errors or crashes after system updates. Monitor for out-of-bounds access errors in kernel logs using dmesg or journalctl commands.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or compromise the integrity of the system by corrupting memory.

Compliance Impact

This vulnerability involves an out-of-bounds memory access in the Linux kernel's zram module, which could lead to memory corruption or crashes. Such low-level memory issues may compromise system integrity and data confidentiality, potentially violating compliance requirements under GDPR (data protection) or HIPAA (health data security) if exploited.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the zram out-of-bounds access issue. Monitor kernel logs for zram-related errors or crashes that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-89719. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70