Executive brief
A vulnerability was identified in the Linux kernel's zram module, which provides compressed RAM-based swap devices. A race condition during data writeback operations can cause the system to crash unexpectedly. This could lead to a denial-of-service, impacting system availability and potentially causing data loss for unsaved work.
Technical details
A use-after-free (UAF) vulnerability exists in the zram driver due to a race condition between the bio completion handler (zram_writeback_endio) and the writeback task. In zram_writeback_endio, the wake_up() function is called on a wait queue after the associated control structure (wb_ctl) may have already been freed by the writeback task on another CPU. This occurs because the writeback task can see the number of inflight requests reach zero and release the control structure before the completion handler finishes its execution. An attacker with local access could potentially trigger this race to cause a kernel panic (denial of service). The issue has been resolved by implementing RCU (Read-Copy-Update) protection to ensure the control structure remains valid until all references are dropped.
Affected products
- Linux Linux Kernel 6.19, 7.0.12, 7.1
Timeline
- 2026-05-12: other: Patch authored
- 2026-07-19: disclosed: CVE published