Description
In the Linux kernel, the following vulnerability has been resolved:

zram: do not forget to endio for partial discard requests

As reported by Qu Wenruo and Avinesh Kumar, the following

getconf PAGESIZE
65536
blkdiscard -p 4k /dev/zram0

takes literally forever to complete. zram doesn't support partial
discards and just returns immediately w/o doing any discard work in such
cases. The problem is that we forget to endio on our way out, so
blkdiscard sleeps forever in submit_bio_wait(). Fix this by jumping to
end_bio label, which does bio_endio().
Published: 2026-05-27
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel’s zram block device driver does not call bio_endio() when handling partial discard requests, causing the I/O operation to never complete. A process issuing blkdiscard for a sub‑page size blocks indefinitely in submit_bio_wait(), effectively hanging the calling task and stalling system responsiveness. The flaw affects only availability and does not provide any direct path to compromise confidentiality or integrity; a successful exploitation results in a denial of service that can disrupt services relying on the zram device.

Affected Systems

All Linux kernel releases that have not yet incorporated the fix associated with commit 2d1f18efccdb8b29552399d024c36b705447e975 are affected. This includes every distribution that has not applied the patch and uses a zram device. Systems that do not enable zram or have disabled the device are not impacted.

Risk and Exploitability

The vulnerability requires local execution of blkdiscard on a /dev/zramX device, meaning the attacker must possess sufficient privileges or device permissions. Once the condition is triggered, the affected process remains blocked forever, leading to a system‑level denial of service. The EPSS score is not available and the flaw is not listed in CISA KEV, but the lack of a defensive mechanism and the high impact on availability indicate a significant risk, particularly in environments where zram is used for memory compression.

Generated by OpenCVE AI on May 27, 2026 at 21:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the kernel to a version that contains the fix (e.g., apply commit 2d1f18efccdb8b29552399d024c36b705447e975 or later).
  • Until a kernel update is deployed, disable zram or modify /dev/zramX permissions so that only trusted privileged users can issue blkdiscard.
  • Avoid issuing partial discard requests; refrain from using blkdiscard with sizes smaller than a full page or switch to storage hardware that correctly handles discard commands.

Generated by OpenCVE AI on May 27, 2026 at 21:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 27 May 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-452
CWE-759

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: zram: do not forget to endio for partial discard requests As reported by Qu Wenruo and Avinesh Kumar, the following getconf PAGESIZE 65536 blkdiscard -p 4k /dev/zram0 takes literally forever to complete. zram doesn't support partial discards and just returns immediately w/o doing any discard work in such cases. The problem is that we forget to endio on our way out, so blkdiscard sleeps forever in submit_bio_wait(). Fix this by jumping to end_bio label, which does bio_endio().
Title zram: do not forget to endio for partial discard requests
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-27T12:58:32.606Z

Reserved: 2026-05-13T15:03:33.096Z

Link: CVE-2026-46089

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:30.443

Modified: 2026-05-27T14:48:03.013

Link: CVE-2026-46089

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T21:30:34Z

Weaknesses