The Linux kernel’s zram subsystem contains a use‑after‑free flaw in its writeback callback zram_writeback_endio. A race condition between the completion handler and the writeback task can cause the control structure wb_ctl to be freed before zram_writeback_endio wakes a waiting process, leading to a NULL pointer dereference that crashes the kernel. The crash results in a denial of service, rendering the affected system inoperable until a reboot or a kernel reload.

All Linux kernels that compiled the zram module prior to the commit that introduced the RCU‑based protection are vulnerable. No specific version numbers are listed, so any kernel release before the fix remains at risk. Kernels that already include the patch are no longer affected.

The vulnerability carries a CVSS score of 7.8 and an EPSS score below 1%, and it is not listed in the CISA KEV catalog. This suggests moderate exploitation likelihood under current public data. Based on the description, the attack vector is inferred to be local or privileged, requiring concurrent writeback operations to trigger the race. However, because the crash can also occur during normal zram activity, the impact remains significant for affected systems.