Executive brief
The zram block device driver in the Linux kernel has a race condition in its locking mechanism on big-endian 64-bit systems. When access time tracking is enabled, CPU cores can corrupt the slot lock bit while updating timestamps, causing multiple CPUs to incorrectly acquire the same lock simultaneously. This can lead to data corruption, loss of data integrity, and potential denial of service.
Technical details
The vulnerability is a race condition in zram's slot locking mechanism due to incorrect bit alignment on big-endian 64-bit architectures. The slot lock uses bit operations on a __lock word that aliases flags and ac_time as two u32 fields. On little-endian systems, the lock bit lands correctly in the flags field; however, on 64-bit big-endian systems, it lands in the ac_time field instead. When ZRAM_TRACK_ENTRY_ACTIME is enabled, mark_slot_accessed() or slot_free() operations overwrite the lock bit while updating access time, allowing concurrent access to the same slot or causing the slot to appear permanently locked. The fix shifts the lock bit position by 32 bits on big-endian 64-bit systems to align it correctly with the flags field. No user interaction is required; the race occurs during normal compressed memory operations.
Affected products
- Linux Linux kernel Multiple versions (zram subsystem affected across kernel 2.6.11+)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-08-24: patched: Fix committed upstream by David Carlier (commit a8b5875741d416703e19ad8eeac6fce8a12bd6e4)
- 2026-09-11: other: Stable backport released by Greg Kroah-Hartman (commit 052b6b2d5fe97547bd2cdb73fa894f6cfea68b11)