CVE-2026-89716 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
zram: validate deflate params
We must validate user-supplied deflate winbits before we pass it to zlib_deflate_workspacesize(), which triggers BUG_ON() if winbits value is outside of valid ranges.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The identified vulnerability resides within the zram subsystem of the Linux kernel, specifically concerning the handling of compression parameters during data deflation operations. Zram functions as a compressed RAM block device, allowing systems to reduce memory footprint by compressing pages in place before swapping them out or storing them on disk-like storage. The core issue arises from insufficient input validation prior to invoking internal library functions that perform critical size calculations for workspace allocation. Specifically, the deflate window bits parameter, which dictates the sliding window size used during LZ77 compression, is accepted directly from user space without rigorous boundary checks before being passed to zlib_deflate_workspacesize(). This function calculates the required memory buffer size based on the provided parameters and contains an internal assertion mechanism designed to catch invalid configurations.
When a malicious or erroneous process supplies a winbits value that falls outside the acceptable range defined by the underlying zlib library, the kernel does not intercept this error condition gracefully. Instead, it proceeds with the calculation, leading zlib_deflate_workspacesize() to trigger a BUG_ON macro. In Linux kernel development, triggering a BUG_ON is equivalent to an intentional panic or crash of the system because it indicates that an internal invariant has been violated and recovery is deemed impossible by the developer who wrote the check. Consequently, this flaw allows any local user with access to the zram device node to induce a denial of service condition by causing the entire kernel to halt, effectively rendering the host machine unresponsive until a manual reboot occurs.
From a classification perspective, this vulnerability aligns closely with CWE-20: Improper Input Validation, as the system fails to verify that user-supplied data conforms to expected constraints before processing it. Furthermore, because the attack vector requires local access to interact with the device interface and results in a complete service disruption rather than privilege escalation or code execution, it maps directly to MITRE ATT&CK technique T1499: Endpoint Denial of Service under the broader category of Resource Hijacking. The lack of sanitization on critical configuration parameters exposes the kernel's internal assumptions about data integrity, which are not guaranteed when dealing with untrusted user-space inputs interacting with block devices.
Mitigation strategies for this vulnerability primarily involve applying the upstream Linux kernel patch that introduces explicit validation logic before calling zlib_deflate_workspacesize(). Administrators should ensure their systems are updated to a version of the kernel where zram properly checks whether winbits is within the valid range supported by zlib, typically between 8 and 15. Until patches can be applied, restricting access permissions to /dev/zram* devices via strict file system ACLs or SELinux policies can limit exposure to privileged users only, thereby reducing the attack surface for local denial-of-service attempts. Additionally, monitoring kernel logs for BUG_ON triggers may help in detecting exploitation attempts of similar flaws in other subsystems that rely on external compression libraries with rigid parameter constraints.