CVE-2026-89717 zram: set default primary compressor in zram_destroy_comps()
A null pointer dereference in the Linux kernel zram module can cause a system crash when accessing compressor settings after destruction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89717?
CVE-2026-89717 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
zram: set default primary compressor in zram_destroy_comps()
Patch series "zram: fix zram issues reported by sashiko".
Sashiko drove by and reported [1] a couple of zram issues: a possible BUG_ON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing.
This patch (of 2):
zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set default primary compressor in zram_destroy_comps().
Which versions are affected by CVE-2026-89717?
How do I fix CVE-2026-89717?
Apply the vendor's patch.
Is CVE-2026-89717 being exploited?
There is no known exploitation of CVE-2026-89717 in the wild and no public exploit code.
Sources
Also known as AZL-100539, BELL-CVE-2026-89717, DEBIAN-CVE-2026-89717, GHSA-5wpf-6ffc-hwm4, UBUNTU-CVE-2026-89717.