CVE-2026-90043

CVE-2026-90043

High · published September 16, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

zram: fix slot lock bit position on big-endian 64-bit

The slot lock is a bit operation on the whole __lock word, which flags and

ac_time alias as two u32s. On little-endian the lock bit lands in the

position ZRAM_ENTRY_LOCK reserves in flags, so the aliasing works out. On

64-bit big-endian it lands in ac_time instead: with

ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time from

mark_slot_accessed() or slot_free() wipes out the held lock bit, letting

another CPU take the same slot lock; an access time value with that bit

set makes the slot look locked forever.

Shift the lock bit into the flags half of the word on big-endian 64-bit.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.4th percentile
Published
2026-09-16T15:17Z
References (2)
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 10:33Z
    zram: fix slot lock bit position on big-endian 64-bit
    cvelistv5