Executive brief
The Linux kernel's zram (RAM disk) compression module failed to validate user-supplied parameters before passing them to the zlib compression library, allowing invalid values to trigger a kernel panic (BUG_ON). A local attacker could cause a denial of service by setting invalid deflate compression parameters through the zram interface.
Technical details
The vulnerability is an input validation flaw in the zram deflate backend (drivers/block/zram/backend_deflate.c). The deflate_setup_params() function accepted user-supplied winbits values without validation before passing them to zlib_deflate_workspacesize(), which enforces strict ranges (−15 to −9 or 9 to 15) via BUG_ON() assertions. An attacker with local access to write to zram sysfs parameters could provide out-of-range winbits values, causing the kernel to panic. The fix adds explicit range validation that rejects invalid values with −EINVAL instead of triggering the BUG_ON().
Affected products
- Linux Linux kernel Multiple versions with zram deflate support (approximately 4.x through 7.x)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Fix committed to stable trees on 2026-09-07; disclosure followed on 2026-09-11