CVE-2026-53185
zram: fix use-after-free in zram_bvec_write_partial()
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page. zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| redhat-SADPADP (enrichment) | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.11% · top 99% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
Affected products
- affected 8e654f8fbff52ac483fb69957222853d7e2fc588 – < 0c2821665ff71be3f4b07ecece384669f2877f6a
- affected 8e654f8fbff52ac483fb69957222853d7e2fc588 – < 77a602b505ce4802915853cfc435a4722fab3e64
- affected 8e654f8fbff52ac483fb69957222853d7e2fc588 – < c96786d6ff1acc1d54d9241e97767554c1dfdd5b
- affected 8e654f8fbff52ac483fb69957222853d7e2fc588 – < 198b5a14cca27263b9c14b20114c8092de15dfcb
- affected 8e654f8fbff52ac483fb69957222853d7e2fc588 – < 732fd9f0b9c1cdc6dfd77162ded60df005182cc0
- affected 4.14
- unaffected < 4.14
- unaffected 6.6.143 – ≤ 6.6.*
- unaffected 6.12.94 – ≤ 6.12.*
- unaffected 6.18.36 – ≤ 6.18.*
- unaffected 7.0.13 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References (13)
- https://git.kernel.org/stable/c/0c2821665ff71be3f4b07ecece384669f2877f6a (opens in a new tab)
- https://git.kernel.org/stable/c/77a602b505ce4802915853cfc435a4722fab3e64 (opens in a new tab)
- https://git.kernel.org/stable/c/c96786d6ff1acc1d54d9241e97767554c1dfdd5b (opens in a new tab)
- https://git.kernel.org/stable/c/198b5a14cca27263b9c14b20114c8092de15dfcb (opens in a new tab)
- https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0 (opens in a new tab)
- https://access.redhat.com/security/cve/CVE-2026-53185 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2492735 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53185.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:61887 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65708 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59723 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63014 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63013 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-53185)Record last updated .