Cloudanix VulnDB

CVE-2026-89717

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the operating system's compressed memory handling could cause unexpected crashes on affected machines.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability is a NULL pointer dereference in zcomp caused by zram_destroy_comps() resetting all compressors including the primary one to NULL, allowing comp_algorithm_show() to dereference a NULL pointer.

Why it matters to the business

Linux systems relying on zram for compressed RAM storage face risk of kernel instability or crashes resulting in service disruption, though the issue is low risk and not known to be actively exploited.

How an attack unfolds

An attacker with local access creates and destroys zram devices to trigger the invalid state where the primary compressor is NULL, then invokes compressor algorithm queries to cause the dereference.

How to fix it

Apply the upstream Linux kernel patch that sets a default primary compressor inside zram_destroy_comps(); rebuild and deploy the updated kernel.

How to confirm the fix worked

Confirm the patch is present in the running kernel source tree or changelog; exercise zram create/destroy cycles and verify no NULL dereference occurs.

Typical attack path

  1. Obtain local user access on a Linux system
  2. Create and configure zram devices
  3. Destroy zram compressors leaving primary set to NULL
  4. Trigger comp_algorithm_show or similar query paths

How to detect it

Inspect kernel logs for oops or panic messages referencing zcomp, zram_destroy_comps, or NULL pointer dereferences during compressor algorithm queries.

What your security team should do

  • Prioritize kernel updates on systems that use zram
  • Review zram usage in production workloads and disable where unnecessary
  • Monitor kernel oops logs for zcomp-related NULL pointer faults

The record

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_destroy_comps() Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported [1] a couple of zram issues: a possible BUG_ON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing. This patch (of 2): zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set default primary compressor in zram_destroy_comps().

Affected packages

Ecosystem Package Introduced Fixed