Cloudanix VulnDB

CVE-2026-89716

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing check in the Linux kernel's compressed memory feature lets an attacker crash the entire computer by feeding it bad settings.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing validation of user-supplied deflate winbits values passed to zlib_deflate_workspacesize() allows out-of-range inputs to reach an internal BUG_ON() assertion, resulting in an immediate kernel panic.

Why it matters to the business

Attackers with the ability to configure zram compression parameters can crash affected Linux systems, causing denial of service, loss of availability, and potential data loss for workloads relying on zram-backed swap or compressed RAM.

How an attack unfolds

An attacker with local access supplies an invalid winbits parameter when initializing or reconfiguring a zram device; the unvalidated value reaches zlib_deflate_workspacesize() and triggers the kernel BUG_ON(), forcing a panic and reboot.

How to fix it

Upgrade to a Linux kernel containing the zram deflate parameter validation fix. Rebuild and reboot onto the patched kernel; disable or avoid custom deflate parameters on unpatched systems until the update is applied.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds explicit winbits range checks before calling zlib_deflate_workspacesize(); attempt to set out-of-range winbits on a test zram device and verify the operation is rejected without a panic.

Typical attack path

  1. Obtain local shell or user context on the target system
  2. Locate or create a zram device via /dev/zram or zramctl
  3. Issue an ioctl or write an invalid deflate winbits value to the compression parameter interface
  4. Trigger the workspace size calculation which hits the unguarded BUG_ON()
  5. Observe kernel panic and system reboot or halt

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or BUG() entries mentioning zram and zlib_deflate_workspacesize around the time of unexpected reboots; correlate with process activity that configures zram devices.

What your security team should do

  • Prioritize kernel updates for all systems using zram compression
  • Restrict unprivileged access to zram configuration interfaces via LSM or mount options
  • Monitor for kernel oops and panic reports referencing zram or zlib_deflate_workspacesize

The record

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlib_deflate_workspacesize(), which triggers BUG_ON() if winbits value is outside of valid ranges.

Affected packages

Ecosystem Package Introduced Fixed