{"id":"CVE-2026-89718","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix out-of-bounds access in writeback_store()\n\nPatch series \"zram: fix stale scan bounds after reinitialization\".\n\nBoth writeback_store() and read_block_state() d…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix out-of-bounds access in writeback_store()\n\nPatch series \"zram: fix stale scan bounds after reinitialization\".\n\nBoth writeback_store() and read_block_state() d…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-131"],"vendor":"Linux","product":"Linux","affected":["Linux >= a939888ec38bf1f33e4a903056677e92a4844244 < 4d82d60178b02797dbe529e01ac211b26670c49f","Linux >= a939888ec38bf1f33e4a903056677e92a4844244 < 07a82a66f8c1894d92e51d97542c32ebf2c51b09","Linux >= a939888ec38bf1f33e4a903056677e92a4844244 < 894913e2d35c46ff19a77530907771ae57862b96","Linux 5.0"],"published":"2026-09-11","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:17:25.967","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89718","references":[{"url":"https://git.kernel.org/stable/c/07a82a66f8c1894d92e51d97542c32ebf2c51b09","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d82d60178b02797dbe529e01ac211b26670c49f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/894913e2d35c46ff19a77530907771ae57862b96","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89718.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89718"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532376"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89718"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89718"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89718.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00166,"epssPercentile":0.06254,"cvssSource":"vendor","ingestedAt":"2026-09-14T11:11:19.885Z","slug":"CVE-2026-89718","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix out-of-bounds access in writeback_store()\n\nPatch series \"zram: fix stale scan bounds after reinitialization\".\n\nBoth writeback_store() and read_block_state() derive their table scan\nbounds from zram->disksize before acquiring dev_lock.  If the device is\nreset and reinitialized with a smaller disksize between that read and lock\nacquisition, the bound can describe the old table while the scan operates\non the new one.  This can lead to out-of-bounds slot accesses.\n\nMove both bound calculations under dev_lock so each bound remains\nconsistent with the table throughout its scan.  Keep the fixes separate\nbecause the affected interfaces originate from different commits and can\nbe backported independently.\n\n\nThis patch (of 2):\n\nwriteback_store() calculates the table scan bounds before taking dev_lock.\nA reset followed by reconfiguration with a smaller disksize can therefore\nreplace zram->table while writeback_store() is waiting for the lock.  Once\nit acquires the lock, it sees an initialized device but scans the new\ntable using the old upper bound, resulting in an out-of-bounds access.\n\nCalculate the number of pages while holding dev_lock so the scan bound\nmatches the table protected by the lock.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89718.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":205441,"id":"CVE-2026-89718","ts":1789576716280,"field":"cvss","old":"4.1","new":"5.5"},{"seq":203965,"id":"CVE-2026-89718","ts":1789490230827,"field":"cvss","old":null,"new":"4.1"},{"seq":203964,"id":"CVE-2026-89718","ts":1789490230827,"field":"severity","old":"none","new":"medium"},{"seq":147293,"id":"CVE-2026-89718","ts":1789270207635,"field":"cvss","old":null,"new":"4.1"},{"seq":147292,"id":"CVE-2026-89718","ts":1789270207635,"field":"severity","old":"none","new":"medium"},{"seq":109050,"id":"CVE-2026-89718","ts":1789183730111,"field":"cvss","old":null,"new":"4.1"},{"seq":109049,"id":"CVE-2026-89718","ts":1789183730111,"field":"severity","old":"none","new":"medium"}]}