CVE-2026-89717 - Vulnerability Details

- zram: set default primary compressor in zram_destroy_comps()

Description

In the Linux kernel, the following vulnerability has been resolved:

zram: set default primary compressor in zram_destroy_comps()

Patch series "zram: fix zram issues reported by sashiko".

Sashiko drove by and reported [1] a couple of zram issues:
a possible BUG_ON() in zlib code due to missing winbits range
validation and one possible NULL-ptr dereference in zcomp.
Both are low risk yet still worth fixing.

This patch (of 2):

zram_destroy_comps() resets all compressors and leaves them set to NULL,
including the primary one, which is invalid device state, as now
comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set
default primary compressor in zram_destroy_comps().

Published: 2026-09-11

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s zram module contains a flaw where the routine that destroys compressors sets the primary compressor pointer to NULL. When later code attempts to compare strings on this pointer, a null pointer dereference can occur, leading to a BUG_ON in the zlib code or a kernel panic. The vulnerability is identified as CWE‑476.

Affected Systems

All Linux kernel builds that do This includes raw kernel binaries as well as distribution kernels that maintain the legacy zram_destroy_comps() logic. Any system that can load or interact with the zram module is potentially at risk.

Risk and Exploitability

The CVSS score of 4.7 indicates moderate severity. The EPSS score of less than 1% reflects a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require local or privileged as interacting with zram interfaces or unloading the module. No publicly announced tools exist; the attack vector is inferred to be local or privileged rather than remote.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`486fd58af7ac1098b68370b1d4d9f94a2a1c7124`	affected	< 4bf3328eeec9afc2a55632ff47fc18101ea62d73
`486fd58af7ac1098b68370b1d4d9f94a2a1c7124`	affected	< 5cec3e60e9f2d1324179df3aa91656f90095cf8f
`486fd58af7ac1098b68370b1d4d9f94a2a1c7124`	affected	< dea8f13c3dfad8b990f8ea96c997aabeebbc1d22
`486fd58af7ac1098b68370b1d4d9f94a2a1c7124`	affected	< dde75313eed0b014c437f48dd75c0308b592cbf9
`6e20720b12299595154857fa98222729f0d5823c`	affected	—
`c4e5683c3031a33dc46954e99d37cbd2f706cdb6`	affected	—
`6.6.57`	affected	< 6.7
`6.11.4`	affected	< 6.12

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.12.111`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[486fd58af7ac1098b68370b1d4d9f94a2a1c7124,5cec3e60e9f2d1324179df3aa91656f90095cf8f)`	affected	code_commit	—
`[486fd58af7ac1098b68370b1d4d9f94a2a1c7124,dea8f13c3dfad8b990f8ea96c997aabeebbc1d22)`	affected	code_commit	—
`[486fd58af7ac1098b68370b1d4d9f94a2a1c7124,dde75313eed0b014c437f48dd75c0308b592cbf9)`	affected	code_commit	—
`6e20720b12299595154857fa98222729f0d5823c`	affected	code_commit	—
`c4e5683c3031a33dc46954e99d37cbd2f706cdb6`	affected	code_commit	—
`[6.6.57,6.7)`	affected	semver	—
`[6.11.4,6.12)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.12`	affected	semver	—
`[0,6.12)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install a kernel version that includes the zram_destroy_comps fix or apply the upstream patch series "zram: fix zram issues reported by sashiko" to set a valid primary compressor.
If zram functionality is not required, disable or unload the zram module to remove the vulnerable code from the running system.
Keep the kernel and distribution packages updated regularly to receive future security patches that may address related or new issues.

Generated by OpenCVE AI on September 15, 2026 at 19:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4bf3328eeec9afc2a55632ff47fc18101ea62d73
https://git.kernel.org/stable/c/5cec3e60e9f2d1324179df3aa91656f90095cf8f
https://git.kernel.org/stable/c/dde75313eed0b014c437f48dd75c0308b592cbf9
https://git.kernel.org/stable/c/dea8f13c3dfad8b990f8ea96c997aabeebbc1d22
https://nvd.nist.gov/vuln/detail/CVE-2026-89717
https://www.cve.org/CVERecord?id=CVE-2026-89717

History

Mon, 21 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4bf3328eeec9afc2a55632ff47fc18101ea62d73

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89717 https://www.cve.org/CVERecord?id=CVE-2026-89717
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_destroy_comps() Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported [1] a couple of zram issues: a possible BUG_ON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing. This patch (of 2): zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set default primary compressor in zram_destroy_comps().
Title		zram: set default primary compressor in zram_destroy_comps()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5cec3e60e9f2d1324179df3aa91656f90095cf8f https://git.kernel.org/stable/c/dde75313eed0b014c437f48dd75c0308b592cbf9 https://git.kernel.org/stable/c/dea8f13c3dfad8b990f8ea96c997aabeebbc1d22

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:30.698Z

Updated: 2026-09-21T13:14:52.732Z

Reserved: 2026-09-11T19:38:34.752Z

Link: CVE-2026-89717

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:59.233

Modified: 2026-09-21T14:17:25.850

Link: CVE-2026-89717

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:30Z

Links: CVE-2026-89717 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T19:30:12Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object