HIGH Introduced in 7.0
zram SlotLock Race
CVE-2026-90043
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit position on big-endian 64-bit The slot lock is a bit operation on the whole __lock word, which flags and ac_time alias as two u32s. On little-endian the lock bit lands in the position ZRAM_ENTRY_LOCK reserves in flags, so the aliasing works out. On 64-bit big-endian it lands in ac_time instead: with ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time from mark_slot_accessed() or slot_free() wipes out the held lock bit, letting another CPU take the same slot lock; an access time value with that bit set makes the slot look locked forever. Shift the lock bit into the flags half of the word on big-endian 64-bit.
02KernelScan AI Analysis
Risk summary
On 64-bit big-endian systems with access-time tracking enabled, the zram slot lock bit is positioned in the wrong half of the lock word, allowing concurrent access to the same slot. Any local process performing I/O on a configured zram device (e.g., via swap) can trigger the race, potentially corrupting kernel memory. Systems on little-endian architectures or without ZRAM_TRACK_ENTRY_ACTIME are unaffected.
Vulnerability analysis
On 64-bit big-endian systems, the zram slot lock bit lands in the access-time half of the lock word instead of the flags half where it belongs. When access-time tracking is enabled, writing an access time overwrites the held lock bit, allowing another CPU to acquire the same slot lock concurrently — or an access-time value with that bit set makes the slot appear permanently locked. This broken locking lets two threads simultaneously read, write, or free the same zram entry, corrupting entry metadata and associated memory. The fix shifts the lock bit into the flags half of the word on 64-bit big-endian, restoring correct mutual exclusion. The vulnerability is reachable by any local process that can trigger I/O on a configured zram device (such as through swap), requiring no special privileges beyond the initial admin setup of the zram device. Only 64-bit big-endian architectures with access-time tracking enabled are affected.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.5 | 052b6b2d5fe9 |
| mainline | 7.0 | 7.3-rc1 | a8b5875741d4 |