CVE-2026-89718

A flaw was found in the zram component of the Linux kernel. This vulnerability occurs because the writeback_store() function calculates table scan bounds before acquiring a necessary lock. If the zram device is reinitialized with a smaller disk size during this window, the function may attempt to access memory outside the allocated table, leading to an out-of-bounds access. This can result in system instability or a denial of service.

A flaw was found in the Linux kernel's zram compressed block device driver. The writeback_store() function computes its table scan bounds from zram->disksize before acquiring the device lock (dev_lock), so if the zram device is reset and reinitialized with a smaller disksize while writeback_store() waits for the lock, it scans the new, smaller table using the stale, larger bound, resulting in an out-of-bounds access to kernel memory. A local attacker with access to the zram control interfaces who can reset and reconfigure a zram device while writeback is triggered could exploit this race condition to crash the kernel, causing a denial of service; confidentiality and integrity are not directly impacted (Red Hat CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases that ship the RHEL 9-based Red Hat Enterprise Linux CoreOS kernel (4.13 and later) are affected. Because this flaw is rated moderate severity with a CVSS score below the threshold used to file fixes, the fix is deferred and no updated packages are currently planned, leaving a residual risk of local denial of service through a kernel crash on affected systems. Red Hat Enterprise Linux 6, 7, and 8 (including kernel-rt) and OpenShift Container Platform 4.12, which ships the RHEL 8-based CoreOS kernel, are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.