CVE-2026-53185

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> zram: fix use-after-free in zram_bvec_write_partial()<br /> <br /> zram_read_page() picks the sync or async backing device read path based on<br /> whether the parent bio is NULL. zram_bvec_write_partial() passes its<br /> parent bio down, so for ZRAM_WB slots the read is dispatched<br /> asynchronously and zram_read_page() returns 0 while the bio is still in<br /> flight. The caller then runs memcpy_from_bvec(), zram_write_page() and<br /> __free_page() on the buffer, leaving the async read to write into a freed<br /> page.<br /> <br /> zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d<br /> ("zram: fix synchronous reads") for the same reason; the write_partial<br /> counterpart was missed.