CVE-2026-53185
published 2026-06-25CVE-2026-53185: In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.10%
0.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
zram: fix use-after-free in zram_bvec_write_partial()
zram_read_page() picks the sync or async backing device read path based on
whether the parent bio is NULL. zram_bvec_write_partial() passes its
parent bio down, so for ZRAM_WB slots the read is dispatched
asynchronously and zram_read_page() returns 0 while the bio is still in
flight. The caller then runs memcpy_from_bvec(), zram_write_page() and
__free_page() on the buffer, leaving the async read to write into a freed
page.
zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d
("zram: fix synchronous reads") for the same reason; the write_partial
counterpart was missed.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 8e654f8fbff52ac483fb69957222853d7e2fc588 < 0c2821665ff71be3f4b07ecece384669f2877f6a | 0c2821665ff71be3f4b07ecece384669f2877f6a |
| linux | linux | >= 8e654f8fbff52ac483fb69957222853d7e2fc588 < 77a602b505ce4802915853cfc435a4722fab3e64 | 77a602b505ce4802915853cfc435a4722fab3e64 |
| linux | linux | >= 8e654f8fbff52ac483fb69957222853d7e2fc588 < c96786d6ff1acc1d54d9241e97767554c1dfdd5b | c96786d6ff1acc1d54d9241e97767554c1dfdd5b |
| linux | linux | >= 8e654f8fbff52ac483fb69957222853d7e2fc588 < 198b5a14cca27263b9c14b20114c8092de15dfcb | 198b5a14cca27263b9c14b20114c8092de15dfcb |
| linux | linux | >= 8e654f8fbff52ac483fb69957222853d7e2fc588 < 732fd9f0b9c1cdc6dfd77162ded60df005182cc0 | 732fd9f0b9c1cdc6dfd77162ded60df005182cc0 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.14 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.7 < 6.12.94 | 6.12.94 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on w
ghsa_unreviewed·2026-06-25
CVE-2026-53185 In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on w
In the Linux kernel, the following vulnerability has been resolved:
zram: fix use-after-free in zram_bvec_write_partial()
zram_read_page() picks the sync or async backing device read path based on
whether the parent bio is NULL. zram_bvec_write_partial() passes its
parent bio down, so for ZRAM_WB slots the read is dispatched
asynchronously and zram_read_page() returns 0 while the bio is still in
flight. The caller then runs memcpy_from_bvec(), zram_write_page() and
__free_page() on the buffer, leaving the async read to write into a freed
page.
zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d
("zram: fix synchronous reads") for the same reason; the write_partial
counterpart was missed.
Red Hat
kernel: zram: fix use-after-free in zram_bvec_write_partial()
vendor_redhat·2026-06-25·CVSS 7.0
CVE-2026-53185 [HIGH] CWE-364 kernel: zram: fix use-after-free in zram_bvec_write_partial()
kernel: zram: fix use-after-free in zram_bvec_write_partial()
A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the `zram_bvec_write_partial()` function allows an asynchronous read to write into a page that has already been deallocated. Such a flaw can lead to system instability, causing crashes, or in some scenarios, could be exploited by a local attacker to escalate privileges or execute arbitrary code.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0c2821665ff71be3f4b07ecece384669f2877f6ahttps://git.kernel.org/stable/c/198b5a14cca27263b9c14b20114c8092de15dfcbhttps://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0https://git.kernel.org/stable/c/77a602b505ce4802915853cfc435a4722fab3e64https://git.kernel.org/stable/c/c96786d6ff1acc1d54d9241e97767554c1dfdd5bhttps://access.redhat.com/security/cve/CVE-2026-53185https://bugzilla.redhat.com/show_bug.cgi?id=2492735https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53185.json
2026-06-25
Published