EUVD-2026-80651
GHSA-6w7g-56x2-f4jj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local zram use gives AV:L/PR:L; big-endian-64-bit-only plus actime config plus a slot race is AC:H; no disclosure (C:N), lock/data corruption (I:L), deadlock/DoS dominant (A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
zram: fix slot lock bit position on big-endian 64-bit
The slot lock is a bit operation on the whole __lock word, which flags and ac_time alias as two u32s. On little-endian the lock bit lands in the position ZRAM_ENTRY_LOCK reserves in flags, so the aliasing works out. On 64-bit big-endian it lands in ac_time instead: with ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time from mark_slot_accessed() or slot_free() wipes out the held lock bit, letting another CPU take the same slot lock; an access time value with that bit set makes the slot look locked forever.
Shift the lock bit into the flags half of the word on big-endian 64-bit.
AnalysisAI
Improper bit placement in the Linux kernel's zram slot-locking code allows a local, authenticated user on 64-bit big-endian systems (s390x, big-endian ppc64, sparc64) to corrupt a per-slot lock word, which can let two CPUs take the same slot lock simultaneously or leave a slot appearing permanently locked, yielding low integrity impact and possible hangs or availability loss. Exploitation requires a 64-bit big-endian kernel built with ZRAM_TRACK_ENTRY_ACTIME enabled, active zram usage (swap or block device) with local activity reaching mark_slot_accessed()/slot_free(), and a successful concurrency race; little-endian architectures such as x86-64 and arm64 are unaffected because the lock bit lands in the correct half of the word there. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of: (1) a 64-bit big-endian kernel architecture (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a classic case of a vendor-assigned CVSS (7.8, AV:L/AC:L/PR:L/C:H/I:H/A:H) that materially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Linux 7.2.5 (stable) and 7.3-rc1, delivered as the upstream stable commits https://git.kernel.org/stable/c/052b6b2d5fe97547bd2cdb73fa894f6cfea68b11 and https://git.kernel.org/stable/c/a8b5875741d416703e19ad8eeac6fce8a12bd6e4; upgrade 64-bit big-endian kernel images (s390x, ppc64 BE, sparc64) to a build containing those commits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all 64-bit big-endian Linux systems (s390x, big-endian ppc64, sparc64) running kernels built with ZRAM_TRACK_ENTRY_ACTIME and active zram swap or block devices, and reconcile kernel versions against the vendor advisory for CVE-2026-90043. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today