CVE-2026-46089 Overview
CVE-2026-46089 is a Linux kernel vulnerability in the zram compressed block device driver. The flaw involves a missing bio_endio() call when zram handles partial discard requests that fall below its supported granularity. When userspace issues a blkdiscard operation smaller than the page size, zram returns early without completing the block I/O, causing the submitter to sleep indefinitely in submit_bio_wait(). The issue was reported by Qu Wenruo and Avinesh Kumar and resolved in the upstream kernel.
Critical Impact
Userspace processes issuing partial discard requests on a zram device hang indefinitely, leading to a local denial of service against any task waiting on the I/O completion.
Affected Products
- Linux kernel zram block device driver
- Systems using zram swap or compressed block storage with non-default PAGESIZE configurations (e.g., 64KB pages)
- Distributions shipping kernels prior to the upstream fix backports
Discovery Timeline
- 2026-05-27 - CVE-2026-46089 published to the National Vulnerability Database (NVD)
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46089
Vulnerability Analysis
The defect lives in the zram block driver, which exposes a compressed, RAM-backed block device. zram operates at page granularity and does not support discard requests smaller than a page. On systems with a large PAGESIZE, such as 64KB on arm64 or ppc64le builds, a blkdiscard -p 4k /dev/zram0 invocation issues sub-page discard bios that zram cannot service.
The handler correctly detected the unsupported case and bailed out, but it skipped the cleanup path that calls bio_endio(). Without bio_endio(), the block layer never marks the bio as complete. The caller, submit_bio_wait(), blocks on its completion variable forever, producing an unkillable wait that the original report described as taking "literally forever to complete."
This is a denial-of-service condition rooted in a control-flow defect. It does not corrupt memory or escalate privileges, but it can wedge backup, provisioning, or filesystem-init tooling that issues fine-grained discards on zram devices.
Root Cause
The partial-discard early-return path omitted the jump to the end_bio label that performs bio_endio(). The fix routes the unsupported partial-discard case through end_bio, ensuring the bio is always completed before the function returns.
Attack Vector
The trigger requires local access and the ability to issue BLKDISCARD ioctls or equivalent discard bios against a zram block device. A standard reproducer is blkdiscard -p 4k /dev/zram0 on a kernel built with a PAGESIZE larger than the discard granularity. Any task waiting on the resulting bio hangs in uninterruptible sleep.
No verified proof-of-concept exploit code is published beyond the reproducer in the upstream commit message. See the kernel commit log for technical details.
Detection Methods for CVE-2026-46089
Indicators of Compromise
- Processes stuck in uninterruptible sleep (D state) with stack traces showing submit_bio_wait and blkdev_issue_discard against a /dev/zram* device
- blkdiscard invocations against zram devices that never return on kernels with PAGESIZE greater than the requested discard length
- Hung-task warnings in dmesg referencing zram discard paths
Detection Strategies
- Inventory running kernel versions across Linux hosts and compare against the patched stable releases referenced by the upstream commits.
- Audit hosts that use zram for swap or compressed storage, particularly arm64, ppc64le, and other large-page builds.
- Review /proc/<pid>/stack for tasks blocked in submit_bio_wait originating from discard syscalls.
Monitoring Recommendations
- Alert on kernel hung-task messages (hung_task_timeout_secs) that reference zram block devices.
- Track blkdiscard, fstrim, and mkfs operations targeting zram devices through audit logging.
- Monitor for sustained uninterruptible-sleep processes performing block I/O against compressed RAM disks.
How to Mitigate CVE-2026-46089
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 2d1f18efccdb, 35d3300f6357, 68ce397e8236, a02363f71a79, and e3668b371329 once available in your distribution's stable kernel.
- Avoid issuing sub-page discard requests against zram devices on affected kernels until the patch is deployed.
- Reboot hosts onto the patched kernel after package installation to ensure the fixed zram module is loaded.
Patch Information
The fix routes the partial-discard early-return through the end_bio label so that bio_endio() is always invoked, preventing the indefinite wait. Patched commits are published in the upstream stable tree: 2d1f18efccdb, 35d3300f6357, 68ce397e8236, a02363f71a79, and e3668b371329.
Workarounds
- Align discard operations to the kernel PAGESIZE so that requests never fall below zram's supported granularity.
- Disable zram on affected hosts where compressed swap or block storage is not required until the patched kernel is deployed.
- Restrict access to /dev/zram* devices to trusted administrators to limit the local denial-of-service surface.
# Verify kernel page size and avoid sub-page discards on zram
getconf PAGESIZE
# Align discard length to PAGESIZE (example for 64KB pages)
blkdiscard -p 65536 /dev/zram0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
