CVE-2026-63951

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> zram: fix use-after-free in zram_writeback_endio<br /> <br /> A crash was observed in zram_writeback_endio due to a NULL pointer<br /> dereference in wake_up. The root cause is a race condition between the<br /> bio completion handler (zram_writeback_endio) and the writeback task.<br /> <br /> In zram_writeback_endio, wake_up() is called on &amp;wb_ctl-&gt;done_wait after<br /> releasing wb_ctl-&gt;done_lock. This creates a race window where the<br /> writeback task can see num_inflight become 0, return, and free wb_ctl<br /> before zram_writeback_endio calls wake_up().<br /> <br /> CPU 0 (zram_writeback_endio) CPU 1 (writeback_store)<br /> ============================ ============================<br /> zram_writeback_slots<br /> zram_submit_wb_request<br /> zram_submit_wb_request<br /> wait_event(wb_ctl-&gt;done_wait)<br /> spin_lock(&amp;wb_ctl-&gt;done_lock);<br /> list_add(&amp;req-&gt;entry, &amp;wb_ctl-&gt;done_reqs);<br /> spin_unlock(&amp;wb_ctl-&gt;done_lock);<br /> wake_up(&amp;wb_ctl-&gt;done_wait);<br /> zram_complete_done_reqs<br /> spin_lock(&amp;wb_ctl-&gt;done_lock);<br /> list_add(&amp;req-&gt;entry, &amp;wb_ctl-&gt;done_reqs);<br /> spin_unlock(&amp;wb_ctl-&gt;done_lock);<br /> while (num_inflight) &gt; 0)<br /> spin_lock(&amp;wb_ctl-&gt;done_lock);<br /> list_del(&amp;req-&gt;entry);<br /> spin_unlock(&amp;wb_ctl-&gt;done_lock);<br /> // num_inflight becomes 0<br /> atomic_dec(num_inflight);<br /> <br /> // Leave zram_writeback_slots<br /> // Free wb_ctl<br /> release_wb_ctl(wb_ctl);<br /> // UAF crash!<br /> wake_up(&amp;wb_ctl-&gt;done_wait);<br /> <br /> This patch fixes this race by using RCU. By protecting wb_ctl with<br /> rcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it,<br /> we ensure that wb_ctl remains valid during the execution of<br /> zram_writeback_endio.