CVE-2026-63951: Linux Kernel Race Condition Vulnerability

CVE-2026-63951 Overview

CVE-2026-63951 is a use-after-free vulnerability in the Linux kernel zram block device driver. The flaw resides in the zram_writeback_endio bio completion handler, where a race condition between the writeback task and the bio completion path allows wb_ctl to be freed while still in use. A local user triggering zram writeback operations can crash the kernel through a NULL pointer dereference in wake_up or corrupt memory referenced through the freed wb_ctl structure.

Critical Impact
Local attackers with the ability to trigger zram writeback can achieve kernel memory corruption, resulting in denial of service and potential local privilege escalation.

Affected Products

Linux kernel versions containing the pre-patch zram writeback implementation
Distributions shipping the vulnerable zram driver prior to the stable backports
Systems using zram-backed swap or compressed block storage with writeback enabled

Discovery Timeline

2026-07-19 - CVE-2026-63951 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63951

Vulnerability Analysis

The vulnerability is a use-after-free ([CWE-416]) triggered by a race condition ([CWE-362]) between two concurrent kernel execution contexts operating on the wb_ctl writeback control structure. The bio completion handler zram_writeback_endio calls wake_up() on &wb_ctl->done_wait after releasing wb_ctl->done_lock. This ordering creates a race window in which the writeback task on another CPU can observe num_inflight reach zero, exit zram_writeback_slots, and call release_wb_ctl(wb_ctl) before the completion handler dereferences the freed pointer.

Root Cause

The root cause lies in the lifetime management of wb_ctl. The completion handler releases the spinlock guarding the completed request list before signaling the waiting writeback task. Once the lock is dropped, no reference or RCU protection keeps wb_ctl alive. The writeback task can drain the completion list, decrement num_inflight to zero, and free the structure. The completion handler then dereferences a stale pointer when calling wake_up(&wb_ctl->done_wait).

Attack Vector

Exploitation requires local access with permission to interact with a zram device configured for writeback. An attacker submits concurrent I/O operations timed to widen the race window between spin_unlock(&wb_ctl->done_lock) and wake_up(&wb_ctl->done_wait) in the completion path. Successful exploitation yields kernel memory corruption. The upstream fix protects wb_ctl with rcu_read_lock() in zram_writeback_endio and defers deallocation using kfree_rcu(), guaranteeing the structure remains valid for the duration of the completion handler.

See the kernel.org commit bf62f695 and kernel.org commit ebe2cbef for the full patch content.

Detection Methods for CVE-2026-63951

Indicators of Compromise

Kernel oops or panic messages referencing zram_writeback_endio or wake_up in the call stack
NULL pointer dereference crashes originating from bio completion contexts on zram devices
Unexpected reboots or BUG: messages on hosts using zram writeback under I/O pressure

Detection Strategies

Audit running kernel versions against the fixed commits bf62f695 and ebe2cbef on affected stable branches
Correlate kernel crash logs (dmesg, /var/log/kern.log, kdump) for zram and wake_up symbols
Monitor for local users creating high-throughput writeback workloads against zram devices

Monitoring Recommendations

Forward kernel ring buffer and crash dumps to a centralized logging platform for symbol-level analysis
Alert on repeated kernel oops events involving the zram module across the fleet
Track sysfs writes to /sys/block/zram*/writeback and related zram control interfaces

How to Mitigate CVE-2026-63951

Immediate Actions Required

Apply the upstream stable kernel updates containing commits bf62f695 and ebe2cbef to all affected hosts
Restrict local shell access on multi-tenant systems using zram writeback until patched
Prioritize patching on systems where untrusted users can trigger zram I/O workloads

Patch Information

The fix is upstream in the Linux kernel stable tree. It introduces RCU protection around wb_ctl in zram_writeback_endio and switches the free path to kfree_rcu(). Refer to kernel.org commit bf62f695 and kernel.org commit ebe2cbef. Rebuild custom kernels against these commits or install vendor packages incorporating them.

Workarounds

Disable zram writeback by not configuring a backing device via /sys/block/zram*/backing_dev
Unload the zram module on systems where it is not required using modprobe -r zram
Limit access to zram control interfaces through strict filesystem permissions on /sys/block/zram*

bash

# Verify the running kernel does not expose zram writeback to unprivileged users
ls -l /sys/block/zram0/writeback /sys/block/zram0/backing_dev 2>/dev/null

# Unload zram if writeback is not required
sudo modprobe -r zram

# Confirm the installed kernel includes the fix commits
uname -r
rpm -q --changelog kernel | grep -E 'bf62f695|ebe2cbef' || \
  dpkg -l | grep linux-image