Executive brief
A vulnerability was identified in the Linux kernel's zram driver, which provides compressed RAM-based swap devices. An error in how the system handles memory writes could allow a 'use-after-free' condition, potentially leading to system instability or a crash. This affects systems using zram with a backing device for writeback operations.
Technical details
A use-after-free vulnerability exists in the Linux kernel zram driver within the zram_bvec_write_partial() function. The root cause is that zram_read_page() determines whether to perform a synchronous or asynchronous read based on whether the parent 'bio' structure is NULL. Because zram_bvec_write_partial() incorrectly passed the parent bio, reads for ZRAM_WB (writeback) slots were dispatched asynchronously. This allowed the function to return 0 and proceed to free the page while the I/O operation was still in flight, resulting in the asynchronous read writing into a freed page. The fix involves passing NULL to zram_read_page() to force synchronous execution. This issue has been patched in multiple stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux 4.14 to 7.0.13
Timeline
- 2026-05-28: other: Vulnerability reported to kernel maintainers
- 2026-06-03: patched: Initial fix committed to mainline kernel
- 2026-06-25: advisory: CVE published and NVD entry created
References
- https://git.kernel.org/stable/c/0c2821665ff71be3f4b07ecece384669f2877f6a
- https://git.kernel.org/stable/c/198b5a14cca27263b9c14b20114c8092de15dfcb
- https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0
- https://git.kernel.org/stable/c/77a602b505ce4802915853cfc435a4722fab3e64
- https://git.kernel.org/stable/c/c96786d6ff1acc1d54d9241e97767554c1dfdd5b