{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "f405066a1f0db818270f49a5e96be329bcabde1e"
            },
            {
              "fixed": "ebe2cbefc86291fa7f386447a81995640df4e2fd"
            },
            {
              "fixed": "bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63951.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix use-after-free in zram_writeback_endio\n\nA crash was observed in zram_writeback_endio due to a NULL pointer\ndereference in wake_up.  The root cause is a race condition between the\nbio completion handler (zram_writeback_endio) and the writeback task.\n\nIn zram_writeback_endio, wake_up() is called on \u0026wb_ctl-\u003edone_wait after\nreleasing wb_ctl-\u003edone_lock.  This creates a race window where the\nwriteback task can see num_inflight become 0, return, and free wb_ctl\nbefore zram_writeback_endio calls wake_up().\n\nCPU 0 (zram_writeback_endio)     CPU 1 (writeback_store)\n============================     ============================\n                                 zram_writeback_slots\n                                   zram_submit_wb_request\n                                   zram_submit_wb_request\n                                   wait_event(wb_ctl-\u003edone_wait)\nspin_lock(\u0026wb_ctl-\u003edone_lock);\nlist_add(\u0026req-\u003eentry, \u0026wb_ctl-\u003edone_reqs);\nspin_unlock(\u0026wb_ctl-\u003edone_lock);\nwake_up(\u0026wb_ctl-\u003edone_wait);\n                                   zram_complete_done_reqs\nspin_lock(\u0026wb_ctl-\u003edone_lock);\nlist_add(\u0026req-\u003eentry, \u0026wb_ctl-\u003edone_reqs);\nspin_unlock(\u0026wb_ctl-\u003edone_lock);\n                                   while (num_inflight) \u003e 0)\n                                     spin_lock(\u0026wb_ctl-\u003edone_lock);\n                                     list_del(\u0026req-\u003eentry);\n                                     spin_unlock(\u0026wb_ctl-\u003edone_lock);\n                                     // num_inflight becomes 0\n                                     atomic_dec(num_inflight);\n\n                                 // Leave zram_writeback_slots\n                                 // Free wb_ctl\n                                 release_wb_ctl(wb_ctl);\n// UAF crash!\nwake_up(\u0026wb_ctl-\u003edone_wait);\n\nThis patch fixes this race by using RCU.  By protecting wb_ctl with\nrcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it,\nwe ensure that wb_ctl remains valid during the execution of\nzram_writeback_endio.",
  "id": "CVE-2026-63951",
  "modified": "2026-07-22T05:30:08.225682716Z",
  "published": "2026-07-19T14:55:44.105Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ebe2cbefc86291fa7f386447a81995640df4e2fd"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63951.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63951"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "zram: fix use-after-free in zram_writeback_endio"
}