CVE-2026-63951 (GCVE-0-2026-63951)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
zram: fix use-after-free in zram_writeback_endio
Summary
In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_writeback_endio A crash was observed in zram_writeback_endio due to a NULL pointer dereference in wake_up. The root cause is a race condition between the bio completion handler (zram_writeback_endio) and the writeback task. In zram_writeback_endio, wake_up() is called on &wb_ctl->done_wait after releasing wb_ctl->done_lock. This creates a race window where the writeback task can see num_inflight become 0, return, and free wb_ctl before zram_writeback_endio calls wake_up(). CPU 0 (zram_writeback_endio) CPU 1 (writeback_store) ============================ ============================ zram_writeback_slots zram_submit_wb_request zram_submit_wb_request wait_event(wb_ctl->done_wait) spin_lock(&wb_ctl->done_lock); list_add(&req->entry, &wb_ctl->done_reqs); spin_unlock(&wb_ctl->done_lock); wake_up(&wb_ctl->done_wait); zram_complete_done_reqs spin_lock(&wb_ctl->done_lock); list_add(&req->entry, &wb_ctl->done_reqs); spin_unlock(&wb_ctl->done_lock); while (num_inflight) > 0) spin_lock(&wb_ctl->done_lock); list_del(&req->entry); spin_unlock(&wb_ctl->done_lock); // num_inflight becomes 0 atomic_dec(num_inflight); // Leave zram_writeback_slots // Free wb_ctl release_wb_ctl(wb_ctl); // UAF crash! wake_up(&wb_ctl->done_wait); This patch fixes this race by using RCU. By protecting wb_ctl with rcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it, we ensure that wb_ctl remains valid during the execution of zram_writeback_endio.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f405066a1f0db818270f49a5e96be329bcabde1e , < ebe2cbefc86291fa7f386447a81995640df4e2fd (git)
Affected: f405066a1f0db818270f49a5e96be329bcabde1e , < bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ebe2cbefc86291fa7f386447a81995640df4e2fd",
              "status": "affected",
              "version": "f405066a1f0db818270f49a5e96be329bcabde1e",
              "versionType": "git"
            },
            {
              "lessThan": "bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43",
              "status": "affected",
              "version": "f405066a1f0db818270f49a5e96be329bcabde1e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix use-after-free in zram_writeback_endio\n\nA crash was observed in zram_writeback_endio due to a NULL pointer\ndereference in wake_up.  The root cause is a race condition between the\nbio completion handler (zram_writeback_endio) and the writeback task.\n\nIn zram_writeback_endio, wake_up() is called on \u0026wb_ctl-\u003edone_wait after\nreleasing wb_ctl-\u003edone_lock.  This creates a race window where the\nwriteback task can see num_inflight become 0, return, and free wb_ctl\nbefore zram_writeback_endio calls wake_up().\n\nCPU 0 (zram_writeback_endio)     CPU 1 (writeback_store)\n============================     ============================\n                                 zram_writeback_slots\n                                   zram_submit_wb_request\n                                   zram_submit_wb_request\n                                   wait_event(wb_ctl-\u003edone_wait)\nspin_lock(\u0026wb_ctl-\u003edone_lock);\nlist_add(\u0026req-\u003eentry, \u0026wb_ctl-\u003edone_reqs);\nspin_unlock(\u0026wb_ctl-\u003edone_lock);\nwake_up(\u0026wb_ctl-\u003edone_wait);\n                                   zram_complete_done_reqs\nspin_lock(\u0026wb_ctl-\u003edone_lock);\nlist_add(\u0026req-\u003eentry, \u0026wb_ctl-\u003edone_reqs);\nspin_unlock(\u0026wb_ctl-\u003edone_lock);\n                                   while (num_inflight) \u003e 0)\n                                     spin_lock(\u0026wb_ctl-\u003edone_lock);\n                                     list_del(\u0026req-\u003eentry);\n                                     spin_unlock(\u0026wb_ctl-\u003edone_lock);\n                                     // num_inflight becomes 0\n                                     atomic_dec(num_inflight);\n\n                                 // Leave zram_writeback_slots\n                                 // Free wb_ctl\n                                 release_wb_ctl(wb_ctl);\n// UAF crash!\nwake_up(\u0026wb_ctl-\u003edone_wait);\n\nThis patch fixes this race by using RCU.  By protecting wb_ctl with\nrcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it,\nwe ensure that wb_ctl remains valid during the execution of\nzram_writeback_endio."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code runs only in the zram writeback path (`writeback_store` \u2192 `zram_writeback_slots` \u2192 `zram_submit_wb_request` \u2192 `zram_writeback_endio`), reachable via local sysfs writes or system daemons that invoke the same sysfs interface; there is no network, Bluetooth, or physical-device entry point.\nAC:L - This is a use-after-free race between batched bio completion handlers and writeback teardown; with default `writeback_batch_size` of 32 the attacker can drive concurrent inflight bios and repeatedly trigger writeback (directly as root or indirectly on Android via memory-pressure-driven `mmd` maintenance), controlling both sides of the race.\nPR:L - On Android phones\u2014the highest-impact deployment\u2014an unprivileged app can induce memory pressure that causes the memory management daemon to invoke `/sys/block/zram0/writeback` without attacker root; alternatively a local admin can write the sysfs attribute directly, but no capability beyond a basic local user is required in the primary mobile scenario.\nUI:N - Exploitation requires no victim interaction beyond normal system operation; automated writeback on memory pressure or attacker-initiated sysfs writeback proceeds without the user mounting filesystems, opening files, or taking deliberate action.\nS:U - Successful exploitation corrupts kernel heap memory and can lead to privilege escalation or kernel crash, but does not cross a VM, IOMMU, or sandbox security boundary beyond standard kernel compromise.\nC:H - The bug is a slab use-after-free on `struct zram_wb_ctl`; `wake_up()` operates on a freed `wait_queue_head_t`, enabling arbitrary kernel memory reads through heap reuse and controlled corruption of wait-queue state.\nI:H - Use-after-free on a kmalloc\u0027d control structure allows heap spraying and corruption of `wait_queue_head_t` and adjacent slab objects, providing a plausible path to arbitrary kernel writes and code execution.\nA:H - A production crash was already observed as a NULL pointer dereference in `wake_up()` during the race, and the underlying use-after-free can reliably cause kernel oops/panic even when not fully weaponized for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:36.330Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ebe2cbefc86291fa7f386447a81995640df4e2fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43"
        }
      ],
      "title": "zram: fix use-after-free in zram_writeback_endio",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63951",
    "datePublished": "2026-07-19T14:55:44.105Z",
    "dateReserved": "2026-07-19T07:54:57.023Z",
    "dateUpdated": "2026-08-05T12:37:36.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63951",
      "date": "2026-09-21",
      "epss": "0.00165",
      "percentile": "0.0614"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/block/zram/zram_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ebe2cbefc86291fa7f386447a81995640df4e2fd",
                    "status": "affected",
                    "version": "f405066a1f0db818270f49a5e96be329bcabde1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43",
                    "status": "affected",
                    "version": "f405066a1f0db818270f49a5e96be329bcabde1e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/block/zram/zram_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.19"
                  },
                  {
                    "lessThan": "6.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix use-after-free in zram_writeback_endio\n\nA crash was observed in zram_writeback_endio due to a NULL pointer\ndereference in wake_up.  The root cause is a race condition between the\nbio completion handler (zram_writeback_endio) and the writeback task.\n\nIn zram_writeback_endio, wake_up() is called on \u0026wb_ctl-\u003edone_wait after\nreleasing wb_ctl-\u003edone_lock.  This creates a race window where the\nwriteback task can see num_inflight become 0, return, and free wb_ctl\nbefore zram_writeback_endio calls wake_up().\n\nCPU 0 (zram_writeback_endio)     CPU 1 (writeback_store)\n============================     ============================\n                                 zram_writeback_slots\n                                   zram_submit_wb_request\n                                   zram_submit_wb_request\n                                   wait_event(wb_ctl-\u003edone_wait)\nspin_lock(\u0026wb_ctl-\u003edone_lock);\nlist_add(\u0026req-\u003eentry, \u0026wb_ctl-\u003edone_reqs);\nspin_unlock(\u0026wb_ctl-\u003edone_lock);\nwake_up(\u0026wb_ctl-\u003edone_wait);\n                                   zram_complete_done_reqs\nspin_lock(\u0026wb_ctl-\u003edone_lock);\nlist_add(\u0026req-\u003eentry, \u0026wb_ctl-\u003edone_reqs);\nspin_unlock(\u0026wb_ctl-\u003edone_lock);\n                                   while (num_inflight) \u003e 0)\n                                     spin_lock(\u0026wb_ctl-\u003edone_lock);\n                                     list_del(\u0026req-\u003eentry);\n                                     spin_unlock(\u0026wb_ctl-\u003edone_lock);\n                                     // num_inflight becomes 0\n                                     atomic_dec(num_inflight);\n\n                                 // Leave zram_writeback_slots\n                                 // Free wb_ctl\n                                 release_wb_ctl(wb_ctl);\n// UAF crash!\nwake_up(\u0026wb_ctl-\u003edone_wait);\n\nThis patch fixes this race by using RCU.  By protecting wb_ctl with\nrcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it,\nwe ensure that wb_ctl remains valid during the execution of\nzram_writeback_endio."
          }
        ],
        "id": "CVE-2026-63951",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:13.837",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ebe2cbefc86291fa7f386447a81995640df4e2fd"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T22:26:38+00:00",
      "cve": "CVE-2026-63951",
      "id": "CVE-2026-63951",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: zram: fix use-after-free in zram_writeback_endio",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63951.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-21T13:02:53Z",
      "cve": "CVE-2026-63951",
      "id": "CVE-2026-63951",
      "initial_release_date": "2026-07-21T13:02:53Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63951",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63951.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.