Strix
64.3K

CVE-2026-89717

UnknownEPSS 0.17%

Last modified

CVE-2026-89717 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_destroy_comps() Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported [1] a couple of zram issues: a possible BUG_ON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing. This patch (of 2): zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set default primary compressor in zram_destroy_comps().. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_destroy_comps() Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported [1] a couple of zram issues: a possible BUG_ON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing. This patch (of 2): zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set default primary compressor in zram_destroy_comps().

Metrics

EPSS Probability
0.17%

6.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 486fd58af7ac1098b68370b1d4d9f94a2a1c7124, < 4bf3328eeec9afc2a55632ff47fc18101ea62d73; >= 486fd58af7ac1098b68370b1d4d9f94a2a1c7124, < 5cec3e60e9f2d1324179df3aa91656f90095cf8f; >= 486fd58af7ac1098b68370b1d4d9f94a2a1c7124, < dea8f13c3dfad8b990f8ea96c997aabeebbc1d22; >= 486fd58af7ac1098b68370b1d4d9f94a2a1c7124, < dde75313eed0b014c437f48dd75c0308b592cbf9; 6e20720b12299595154857fa98222729f0d5823c; c4e5683c3031a33dc46954e99d37cbd2f706cdb6; >= 6.6.57, < 6.7; >= 6.11.4, < 6.12
LinuxLinux6.12

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89717?
In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_destroy_comps() Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported [1] a couple of zram issues: a possible BUG_ON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing. This patch (of 2): zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set default primary compressor in zram_destroy_comps().
How severe is CVE-2026-89717?
Severity scoring for CVE-2026-89717 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-89717?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89717?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST