CVE-2026-89717

A flaw was found in the zram component of the Linux kernel. When zram_destroy_comps() is called, it incorrectly resets the primary compressor to a NULL state. This invalid state can lead to a NULL pointer dereference when comp_algorithm_show() attempts to access the compressor, potentially causing system instability or a denial of service. This issue is considered low risk.

A low impact NULL pointer dereference flaw was found in the zram module of the Linux kernel shipped in Red Hat Enterprise Linux 9 and in the RHCOS 9 kernels used by OpenShift Container Platform 4.19 and later. When zram_destroy_comps() is called, it resets all compressors and leaves the primary compressor set to NULL, which is an invalid device state; comp_algorithm_show() can subsequently call strcmp() on that NULL compressor, causing a NULL pointer dereference. A local user with the privileges needed to manage zram devices could exploit this flaw to crash the kernel and cause a denial of service; confidentiality and integrity are not affected. Older products are not affected because the vulnerable code is not present in their kernels: Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 and 9.4 streams, and OpenShift Container Platform 4.12 through 4.18. For the affected streams (RHEL 9.6 and later, OpenShift Container Platform 4.19 and later, and OpenShift 5.x), the fix is deferred because the CVSS 3.1 score of 5.5 is below the 7.0 threshold at which Red Hat prioritizes fixes at this impact level; the residual risk is limited to local denial of service with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.