CVE-2026-89716: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89716 Overview

CVE-2026-89716 affects the Linux kernel's zram compressed block device subsystem. The vulnerability stems from missing validation of user-supplied deflate window bits (winbits) before they are passed to zlib_deflate_workspacesize(). When winbits falls outside the valid range, the zlib function triggers a BUG_ON(), causing a kernel panic. A local user with permission to configure zram algorithm parameters can trigger this condition and cause a denial of service. Upstream maintainers resolved the issue by validating the deflate parameters before they reach the zlib workspace sizing routine.

Critical Impact
A local user able to set zram deflate parameters can trigger a kernel BUG_ON() in zlib_deflate_workspacesize(), producing a kernel panic and denial of service on the affected host.

Affected Products

Linux kernel zram block device subsystem
Kernel branches receiving the fix in commits 923578d, e23fac4, and ec7607a
Distributions shipping vulnerable stable kernel versions prior to backporting the fix

Discovery Timeline

2026-09-11 - CVE-2026-89716 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89716

Vulnerability Analysis

The zram driver exposes tunables that allow userspace to configure compression algorithm parameters, including deflate-specific settings. One of these settings is the window bits value that controls the sliding window size used by the zlib deflate implementation. The kernel passed this value directly into zlib_deflate_workspacesize() without range checking.

zlib_deflate_workspacesize() enforces its input contract with a BUG_ON() assertion. Supplying a winbits value outside the accepted range converts a userspace configuration error into an unrecoverable kernel condition. The result is an immediate kernel panic rather than a graceful error return to userspace.

The fix, applied across the referenced stable commits, validates the caller-supplied deflate parameters at the zram configuration layer. Invalid values are rejected with an appropriate error code before they can reach the zlib helper. This is a kernel input validation flaw in a driver that trusts userspace-provided data.

Root Cause

The root cause is missing input validation on user-controlled parameters passed to a kernel helper that treats out-of-range values as programmer errors. zlib_deflate_workspacesize() uses BUG_ON() to enforce its API contract, so any caller that forwards unvalidated userspace data can trigger a panic.

Attack Vector

Exploitation requires local access with the ability to write zram algorithm parameters, typically through the zram sysfs interface. An attacker sets the deflate winbits parameter to a value outside the supported range and then triggers a code path that allocates the workspace. The kernel executes the BUG_ON() and panics. There is no evidence of remote exploitation, and no public proof-of-concept is referenced in the advisory.

No verified exploit code is available. See the upstream commits for the exact validation logic added by the maintainers: Kernel Git Commit 923578d, Kernel Git Commit e23fac4, and Kernel Git Commit ec7607a.

Detection Methods for CVE-2026-89716

Indicators of Compromise

Kernel panic messages referencing zlib_deflate_workspacesize or BUG_ON in lib/zlib_deflate/deflate.c call stacks.
Unexpected host reboots on systems that expose zram sysfs attributes to non-root or containerized workloads.
Writes to /sys/block/zram*/algorithm_params with unusual winbits values in audit logs.

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for panic traces originating in the zram or zlib deflate code paths.
Audit process activity that writes to zram sysfs configuration files, especially from unprivileged or container contexts.
Correlate abrupt host restarts with prior sysfs writes to zram algorithm parameters using centralized log analysis.

Monitoring Recommendations

Enable auditd rules on /sys/block/zram*/ to record configuration changes and the invoking UID.
Ship kernel ring buffer contents to a centralized log store so panic traces survive host reboots.
Alert on repeated crash-reboot cycles for hosts running vulnerable kernel versions until patching is complete.

How to Mitigate CVE-2026-89716

Immediate Actions Required

Inventory Linux hosts running kernels that predate the fix commits and prioritize those exposing zram to untrusted local users or containers.
Restrict write access to zram sysfs attributes to root and remove unnecessary capability grants from containers.
Deploy the vendor-supplied kernel update that includes the deflate parameter validation patch.

Patch Information

The fix is present in upstream stable commits 923578d0f0d0703c3db61ab35dc37075ae53b0bd, e23fac4ab2a5728386477b98a402a1042b21bffb, and ec7607ac4717ff521c9c1e9d8271c26293345513. Apply the corresponding distribution kernel update that backports these commits. Rebuild and reboot to activate the patched kernel.

Workarounds

Disable the zram module (modprobe -r zram) on systems where compressed swap or block devices are not required.
Avoid selecting the deflate compression algorithm for zram until the patched kernel is installed.
Remove CAP_SYS_ADMIN and direct sysfs write permissions from workloads that do not require zram tuning.

bash

# Configuration example: restrict zram sysfs access and unload the module
chmod 600 /sys/block/zram0/algorithm_params 2>/dev/null
swapoff /dev/zram0 2>/dev/null
modprobe -r zram