CVE-2026-63951

In the Linux kernel, the following vulnerability has been resolved:

zram: fix use-after-free in zramwritebackendio

A crash was observed in zramwritebackendio due to a NULL pointer dereference in wakeup. The root cause is a race condition between the bio completion handler (zramwriteback_endio) and the writeback task.

In zramwritebackendio, wakeup() is called on &wbctl->donewait after releasing wbctl->donelock. This creates a race window where the writeback task can see numinflight become 0, return, and free wbctl before zramwritebackendio calls wakeup().

CPU 0 (zramwritebackendio) CPU 1 (writebackstore) ============================ ============================ zramwritebackslots zramsubmitwbrequest zramsubmitwbrequest waitevent(wbctl->donewait) spinlock(&wbctl->donelock); listadd(&req->entry, &wbctl->donereqs); spinunlock(&wbctl->donelock); wakeup(&wbctl->donewait); zramcompletedonereqs spinlock(&wbctl->donelock); listadd(&req->entry, &wbctl->donereqs); spinunlock(&wbctl->donelock); while (numinflight) > 0) spinlock(&wbctl->donelock); listdel(&req->entry); spinunlock(&wbctl->donelock); // numinflight becomes 0 atomicdec(num_inflight);

                             // Leave zram_writeback_slots
                             // Free wb_ctl
                             release_wb_ctl(wb_ctl);

// UAF crash! wakeup(&wbctl->done_wait);

This patch fixes this race by using RCU. By protecting wbctl with rcureadlock() in zramwritebackendio and using kfreercu() to free it, we ensure that wbctl remains valid during the execution of zramwriteback_endio.