CVE-2026-89719

A flaw was found in the Linux kernel's zram module. This vulnerability occurs when the read_block_state() function calculates the number of pages before acquiring a device lock. If the zram device is reset and reinitialized with a smaller disk size, the function can attempt to access memory beyond the bounds of the newly allocated table. This out-of-bounds access can lead to system instability or a denial of service (DoS).

A race in zram read_block_state can calculate nr_pages from the old disksize before dev_lock is acquired. If the device is reset and reinitialized with a smaller disksize before the lock is taken, the later scan can use the stale larger bound and call slot_lock past the end of the newly allocated zram table. This is a local race condition and an out of bounds access candidate rather than a network reachable bug. For the CVSS the PR:L is used for the paranoid score because some deployments may delegate zram or debugfs control to a reduced capability root, container root, or service account rather than full host administration. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact because slot locking past the table boundary can touch memory outside the intended allocation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.