Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-53185

zram: fix use-after-free in zram_bvec_write_partial()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page. zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 8e654f8fbff52ac483fb69957222853d7e2fc588 to < 0c2821665ff71be3f4b07ecece384669f2877f6aaffected
  • 8e654f8fbff52ac483fb69957222853d7e2fc588 to < 77a602b505ce4802915853cfc435a4722fab3e64affected
  • 8e654f8fbff52ac483fb69957222853d7e2fc588 to < c96786d6ff1acc1d54d9241e97767554c1dfdd5baffected
  • 8e654f8fbff52ac483fb69957222853d7e2fc588 to < 198b5a14cca27263b9c14b20114c8092de15dfcbaffected
  • 8e654f8fbff52ac483fb69957222853d7e2fc588 to < 732fd9f0b9c1cdc6dfd77162ded60df005182cc0affected

Linux Linux

Default version status: affected

  • 4.14affected
  • 0 to < 4.14unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.94 to ≤ 6.12.*unaffected
  • 6.18.36 to ≤ 6.18.*unaffected
  • 7.0.13 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References