CVE-2026-89719

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

zram: fix out-of-bounds access in read_block_state()

read_block_state() calculates nr_pages before taking dev_lock. If the

device is reset and reinitialized with a smaller disksize before lock

acquisition, nr_pages still describes the old table. The subsequent loop

can then call slot_lock() past the end of the newly allocated table.

Read disksize after acquiring dev_lock and checking that the device is

initialized. The read lock then keeps the table and its bound stable for

the duration of the scan.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References