CVE-2026-53185

In the Linux kernel, the following vulnerability has been resolved:

zram: fix use-after-free in zram_bvec_write_partial()

zram_read_page() picks the sync or async backing device read path based on

whether the parent bio is NULL. zram_bvec_write_partial() passes its

parent bio down, so for ZRAM_WB slots the read is dispatched

asynchronously and zram_read_page() returns 0 while the bio is still in

flight. The caller then runs memcpy_from_bvec(), zram_write_page() and

__free_page() on the buffer, leaving the async read to write into a freed

page.

zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d

("zram: fix synchronous reads") for the same reason; the write_partial

counterpart was missed.