CVE-2026-89717: Linux Kernel zram Use-After-Free Vulnerability

CVE-2026-89717 Overview

CVE-2026-89717 is a NULL pointer dereference vulnerability in the Linux kernel's zram compressed RAM block device subsystem. The flaw resides in zram_destroy_comps(), which resets all compressor pointers, including the primary compressor, to NULL. This leaves the device in an invalid state where subsequent calls to comp_algorithm_show() invoke strcmp() on a NULL pointer. The issue was reported by a contributor referenced as "sashiko" and has been resolved upstream by restoring the default primary compressor within zram_destroy_comps().

Critical Impact
A local user with permission to interact with the zram sysfs interface can trigger a kernel NULL pointer dereference, resulting in a denial-of-service condition.

Affected Products

Linux kernel versions containing the vulnerable zram_destroy_comps() implementation
Distributions shipping the zram block device driver with the affected code path
Systems using zram-backed swap or compressed storage before the upstream fix

Discovery Timeline

2026-09-11 - CVE-2026-89717 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89717

Vulnerability Analysis

The zram driver exposes compressed block devices backed by RAM, commonly used for swap acceleration and tmpfs-style workloads. Each zram device maintains an array of compressor handles, with one designated as the primary algorithm exposed through the comp_algorithm sysfs attribute.

The function zram_destroy_comps() iterates through the compressor slots and clears them, leaving the primary entry unset. Because the sysfs show callback comp_algorithm_show() calls strcmp() against the primary compressor name without a NULL check, any subsequent read of the attribute dereferences a NULL pointer in kernel context. This triggers an oops and, depending on kernel configuration, a panic under panic_on_oops.

The reporter also flagged a related BUG_ON() risk in the zlib code path due to missing winbits range validation, addressed by a separate patch in the same series.

Root Cause

The root cause is missing state restoration in zram_destroy_comps(). The function tears down compressor instances without reinitializing the primary compressor slot to the default algorithm. This produces an invalid device state that violates the invariant assumed by downstream sysfs handlers, which expect the primary compressor pointer to remain non-NULL for the lifetime of the device.

Attack Vector

Exploitation requires local access to a system with the zram driver loaded and the ability to trigger the destroy path followed by a read of the comp_algorithm sysfs attribute. The attack does not yield code execution or privilege escalation; the observable impact is a kernel NULL pointer dereference that disrupts availability. The vulnerability is not known to be exploited in the wild and is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. See the upstream commits Kernel Git Commit 5cec3e6, Kernel Git Commit dde7531, and Kernel Git Commit dea8f13 for the patch details.

Detection Methods for CVE-2026-89717

Indicators of Compromise

Kernel oops or panic entries in dmesg or /var/log/kern.log referencing comp_algorithm_show or zram_destroy_comps in the call trace.
Unexpected termination or hang of processes reading /sys/block/zram*/comp_algorithm.
Repeated zram device reset operations followed by sysfs reads from non-root monitoring agents.

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereference traces originating from the zram subsystem.
Audit sysfs access patterns to /sys/block/zram*/ attributes, correlating writes to reset with subsequent reads of comp_algorithm.
Track kernel version inventory against the fixed commits to identify hosts still exposed to the vulnerable code path.

Monitoring Recommendations

Enable kernel crash collection via kdump or equivalent to capture oops traces for post-incident analysis.
Forward kern.log and journald kernel messages to a centralized logging platform for pattern matching on zram-related faults.
Alert on unexpected kernel panics on hosts that use zram-backed swap, particularly in shared or multi-tenant environments.

How to Mitigate CVE-2026-89717

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisory as soon as vendor-packaged updates are available.
Restrict local user access to hosts running vulnerable zram configurations, especially in multi-tenant environments.
Inventory systems using zram for swap or compressed storage and prioritize them for patching.

Patch Information

The fix restores the default primary compressor within zram_destroy_comps(), preserving valid device state after teardown. The patch is available in the upstream stable tree via commits 5cec3e6, dde7531, and dea8f13. Apply the vendor-backported kernel package appropriate for your distribution.

Workarounds

Unload the zram kernel module on systems that do not require compressed RAM devices using modprobe -r zram.
Restrict read access to /sys/block/zram*/comp_algorithm where operationally feasible to reduce trigger surface.
Disable zram-backed swap in systemd-zram-generator or equivalent configuration until patched kernels are deployed.

bash

# Configuration example: disable and unload the zram module
sudo swapoff /dev/zram0 2>/dev/null
sudo systemctl disable --now systemd-zram-setup@zram0.service 2>/dev/null
sudo modprobe -r zram
echo "blacklist zram" | sudo tee /etc/modprobe.d/blacklist-zram.conf