CVE-2026-89719

In the Linux kernel, the following vulnerability has been resolved:

zram: fix out-of-bounds access in read block state()

read block state() calculates nr pages before taking dev lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr pages still describes the old table. The subsequent loop can then call slot lock() past the end of the newly allocated table.

Read disksize after acquiring dev lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.