---
id: CVE-2026-89717
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  zram: set default primary compressor in zram_destroy_comps()

  Patch series "zram: fix zram issues reported by sashiko".

  Sashiko drove by and reported [1] a couple of z…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  zram: set default primary compressor in zram_destroy_comps()

  Patch series "zram: fix zram issues reported by sashiko".

  Sashiko drove by and reported [1] a couple of z…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 <
    4bf3328eeec9afc2a55632ff47fc18101ea62d73
  - >-
    Linux >= 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 <
    5cec3e60e9f2d1324179df3aa91656f90095cf8f
  - >-
    Linux >= 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 <
    dea8f13c3dfad8b990f8ea96c997aabeebbc1d22
  - >-
    Linux >= 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 <
    dde75313eed0b014c437f48dd75c0308b592cbf9
  - Linux 6e20720b12299595154857fa98222729f0d5823c
  - Linux c4e5683c3031a33dc46954e99d37cbd2f706cdb6
  - Linux >= 6.6.57 < 6.7
  - Linux >= 6.11.4 < 6.12
  - Linux 6.12
published: '2026-09-11'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:25.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89717'
references:
  - url: 'https://git.kernel.org/stable/c/4bf3328eeec9afc2a55632ff47fc18101ea62d73'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5cec3e60e9f2d1324179df3aa91656f90095cf8f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dde75313eed0b014c437f48dd75c0308b592cbf9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dea8f13c3dfad8b990f8ea96c997aabeebbc1d22'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89717.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89717'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532278'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89717'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89717'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89717.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00209
epssPercentile: 0.09793
cvssSource: vendor
ingestedAt: '2026-09-14T11:11:19.885Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

zram: set default primary compressor in zram_destroy_comps()

Patch series "zram: fix zram issues reported by sashiko".

Sashiko drove by and reported [1] a couple of zram issues:
a possible BUG_ON() in zlib code due to missing winbits range
validation and one possible NULL-ptr dereference in zcomp.
Both are low risk yet still worth fixing.


This patch (of 2):

zram_destroy_comps() resets all compressors and leaves them set to NULL,
including the primary one, which is invalid device state, as now
comp_algorithm_show()->strcmp() can be called on a NULL compressor.  Set
default primary compressor in zram_destroy_comps().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89717.json)