CVE-2026-53185

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page. zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed.

Score
CVSS 3.1 7.8 High
Status
Modified - 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-06-25
Last modified
2026-10-19
Weaknesses
CWE-364, CWE-416

Affected products

References

 
 
© AVABIS GmbH privacypolicy about