{"id":"AZL-100860","summary":"CVE-2026-89719 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix out-of-bounds access in read_block_state()\n\nread_block_state() calculates nr_pages before taking dev_lock.  If the\ndevice is reset and reinitialized with a smaller disksize before lock\nacquisition, nr_pages still describes the old table.  The subsequent loop\ncan then call slot_lock() past the end of the newly allocated table.\n\nRead disksize after acquiring dev_lock and checking that the device is\ninitialized.  The read lock then keeps the table and its bound stable for\nthe duration of the scan.","modified":"2026-09-12T14:15:34.631611918Z","published":"2026-09-11T20:20:00Z","upstream":["CVE-2026-89719"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89719"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100860.json"}}],"schema_version":"1.9.0"}