CVE-2026-89717
In the Linux kernel, the following vulnerability has been resolved:
zram: set default primary compressor in zram_destroy_comps()
Patch series "zram: fix zram issues reported by sashiko".
Sashiko drove by and reported [1] a couple of zram issues: a possible BUG_ON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing.
This patch (of 2):
zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set default primary compressor in zram_destroy_comps().
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.17%
- Percentil entre todas las CVEs puntuadas: 5
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-89717",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "486fd58af7ac1098b68370b1d4d9f94a2a1c7124",
"lessThan": "4bf3328eeec9afc2a55632ff47fc18101ea62d73",
"versionType": "git"
},
{
"status": "affected",
"version": "486fd58af7ac1098b68370b1d4d9f94a2a1c7124",
"lessThan": "5cec3e60e9f2d1324179df3aa91656f90095cf8f",
"versionType": "git"
},
{
"status": "affected",
"version": "486fd58af7ac1098b68370b1d4d9f94a2a1c7124",
"lessThan": "dea8f13c3dfad8b990f8ea96c997aabeebbc1d22",
"versionType": "git"
},
{
"status": "affected",
"version": "486fd58af7ac1098b68370b1d4d9f94a2a1c7124",
"lessThan": "dde75313eed0b014c437f48dd75c0308b592cbf9",
"versionType": "git"
},
{
"status": "affected",
"version": "6e20720b12299595154857fa98222729f0d5823c",
"versionType": "git"
},
{
"status": "affected",
"version": "c4e5683c3031a33dc46954e99d37cbd2f706cdb6",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.57",
"lessThan": "6.7",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.11.4",
"lessThan": "6.12",
"versionType": "semver"
}
],
"programFiles": [
"drivers/block/zram/zram_drv.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/block/zram/zram_drv.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-11T20:19:59.233",
"references": [
{
"url": "https://git.kernel.org/stable/c/4bf3328eeec9afc2a55632ff47fc18101ea62d73",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5cec3e60e9f2d1324179df3aa91656f90095cf8f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dde75313eed0b014c437f48dd75c0308b592cbf9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dea8f13c3dfad8b990f8ea96c997aabeebbc1d22",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: set default primary compressor in zram_destroy_comps()\n\nPatch series \"zram: fix zram issues reported by sashiko\".\n\nSashiko drove by and reported [1] a couple of zram issues:\na possible BUG_ON() in zlib code due to missing winbits range\nvalidation and one possible NULL-ptr dereference in zcomp.\nBoth are low risk yet still worth fixing.\n\n\nThis patch (of 2):\n\nzram_destroy_comps() resets all compressors and leaves them set to NULL,\nincluding the primary one, which is invalid device state, as now\ncomp_algorithm_show()->strcmp() can be called on a NULL compressor. Set\ndefault primary compressor in zram_destroy_comps()."
}
],
"lastModified": "2026-09-21T14:17:25.850",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}