Not yet scoredPublished Sep 11, 2026

CVE-2026-89717zram: set default primary compressor in zram_destroy_comps()

Updated under an hour ago (Oct 27, 2026, 1:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_destroy_comps() Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported [1] a couple of zram issues: a possible BUG_ON() in zlib code due to missing winbits range validation and one possible NULL-ptr dereference in zcomp. Both are low risk yet still worth fixing. This patch (of 2): zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state, as now comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set default primary compressor in zram_destroy_comps().

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 6e20720b12299595154857fa98222729f0d5823c before a5fda7def04d98ab7c5cbb2394714fb1f8c56cb5; 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 builds before 4bf3328eeec9afc2a55632ff47fc18101ea62d73; 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 builds before 5cec3e60e9f2d1324179df3aa91656f90095cf8f; from 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 before dea8f13c3dfad8b990f8ea96c997aabeebbc1d22; from 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 before dde75313eed0b014c437f48dd75c0308b592cbf9; c4e5683c3031a33dc46954e99d37cbd2f706cdb6; from 6.6.57 before 6.6.160; from 6.11.4 before 6.12	CNA record

References

References

https://git.kernel.org/stable/c/a5fda7def04d98ab7c5cbb2394714fb1f8c56cb5
https://git.kernel.org/stable/c/4bf3328eeec9afc2a55632ff47fc18101ea62d73
https://git.kernel.org/stable/c/5cec3e60e9f2d1324179df3aa91656f90095cf8f
https://git.kernel.org/stable/c/dea8f13c3dfad8b990f8ea96c997aabeebbc1d22
https://git.kernel.org/stable/c/dde75313eed0b014c437f48dd75c0308b592cbf9

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.