206 lines
10 KiB
JSON
206 lines
10 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-89718",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-11T19:38:34.752Z",
|
|
"datePublished": "2026-09-11T19:46:31.443Z",
|
|
"dateUpdated": "2026-10-30T12:32:49.752Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:32:49.752Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix out-of-bounds access in writeback_store()\n\nPatch series \"zram: fix stale scan bounds after reinitialization\".\n\nBoth writeback_store() and read_block_state() derive their table scan\nbounds from zram->disksize before acquiring dev_lock. If the device is\nreset and reinitialized with a smaller disksize between that read and lock\nacquisition, the bound can describe the old table while the scan operates\non the new one. This can lead to out-of-bounds slot accesses.\n\nMove both bound calculations under dev_lock so each bound remains\nconsistent with the table throughout its scan. Keep the fixes separate\nbecause the affected interfaces originate from different commits and can\nbe backported independently.\n\n\nThis patch (of 2):\n\nwriteback_store() calculates the table scan bounds before taking dev_lock.\nA reset followed by reconfiguration with a smaller disksize can therefore\nreplace zram->table while writeback_store() is waiting for the lock. Once\nit acquires the lock, it sees an initialized device but scans the new\ntable using the old upper bound, resulting in an out-of-bounds access.\n\nCalculate the number of pages while holding dev_lock so the scan bound\nmatches the table protected by the lock."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/block/zram/zram_drv.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "a939888ec38bf1f33e4a903056677e92a4844244",
|
|
"lessThan": "f1c5611f699a3aa2a85ebd5fec03dc9bc501e6d0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a939888ec38bf1f33e4a903056677e92a4844244",
|
|
"lessThan": "c2745e657f0974871fbc60d46d48c2b04e581330",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a939888ec38bf1f33e4a903056677e92a4844244",
|
|
"lessThan": "4d82d60178b02797dbe529e01ac211b26670c49f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a939888ec38bf1f33e4a903056677e92a4844244",
|
|
"lessThan": "ef073edd7cfd31aeb90eeab23273102c601f4d8e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a939888ec38bf1f33e4a903056677e92a4844244",
|
|
"lessThan": "07a82a66f8c1894d92e51d97542c32ebf2c51b09",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a939888ec38bf1f33e4a903056677e92a4844244",
|
|
"lessThan": "894913e2d35c46ff19a77530907771ae57862b96",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/block/zram/zram_drv.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.0",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.0",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.111",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.57",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.4",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "6.12.111"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "6.18.57"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "7.2.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f1c5611f699a3aa2a85ebd5fec03dc9bc501e6d0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c2745e657f0974871fbc60d46d48c2b04e581330"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4d82d60178b02797dbe529e01ac211b26670c49f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ef073edd7cfd31aeb90eeab23273102c601f4d8e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/07a82a66f8c1894d92e51d97542c32ebf2c51b09"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/894913e2d35c46ff19a77530907771ae57862b96"
|
|
}
|
|
],
|
|
"title": "zram: fix out-of-bounds access in writeback_store()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |