{"cve":"CVE-2026-89717","nvd":{"published":"2026-09-11T20:19:59.233","modified":"2026-10-21T13:20:22.557","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nzram: set default primary compressor in zram_destroy_comps()\n\nPatch series \"zram: fix zram issues reported by sashiko\".\n\nSashiko drove by and reported [1] a couple of zram issues:\na possible BUG_ON() in zlib code due to missing winbits range\nvalidation and one possible NULL-ptr dereference in zcomp.\nBoth are low risk yet still worth fixing.\n\n\nThis patch (of 2):\n\nzram_destroy_comps() resets all compressors and leaves them set to NULL,\nincluding the primary one, which is invalid device state, as now\ncomp_algorithm_show()->strcmp() can be called on a NULL compressor.  Set\ndefault primary compressor in zram_destroy_comps().","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/4bf3328eeec9afc2a55632ff47fc18101ea62d73","https://git.kernel.org/stable/c/5cec3e60e9f2d1324179df3aa91656f90095cf8f","https://git.kernel.org/stable/c/a5fda7def04d98ab7c5cbb2394714fb1f8c56cb5","https://git.kernel.org/stable/c/dde75313eed0b014c437f48dd75c0308b592cbf9","https://git.kernel.org/stable/c/dea8f13c3dfad8b990f8ea96c997aabeebbc1d22"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-89717","score":0.00168,"percentile":0.06156,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}