CVE-2026-89719
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table. The subsequent loop can then call slot_lock() past the end of the newly allocated table. Read disksize after acquiring dev_lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.
Affected versions
Linux kernel versions
4.18
and later are affected. Fixed in
6.12.111,
6.18.51,
7.2.4,
7.3-rc1
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-89719?
CVE-2026-89719 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.18 onward and has been patched in 6.12.111, 6.18.51, 7.2.4 and others. CVE-2026-89719 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89719?
Yes. CVE-2026-89719 has been patched. Fixed versions include 6.12.111, 6.18.51, 7.2.4 and others. If you are running Linux kernel 4.18 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89719 actively exploited?
No. CVE-2026-89719 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.