Skip to content
OpenAdvisories
Unscored CVE-2024-53222 EUVD-2024-51894GHSA-rxh5-6q4f-cfwp

zram: fix NULL pointer in comp_algorithm_show()

Published Dec 27, 2024 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: kernel Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-nvidia Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-xilinx Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

zram: fix NULL pointer in comp_algorithm_show()

LTP reported a NULL pointer dereference as followed:

CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3
Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __pi_strcmp+0x24/0x140
lr : zcomp_available_show+0x60/0x100 [zram]
sp : ffff800088b93b90
x29: ffff800088b93b90 x28: 0000000000000001 x27: 0000000000400cc0
x26: 0000000000000ffe x25: ffff80007b3e2388 x24: 0000000000000000
x23: ffff80007b3e2390 x22: ffff0004041a9000 x21: ffff80007b3e2900
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: ffff80007b3e2900 x9 : ffff80007b3cb280
x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 00656c722d6f7a6c
x2 : 0000000000000000 x1 : ffff80007b3e2900 x0 : 0000000000000000
Call trace:
__pi_strcmp+0x24/0x140
comp_algorithm_show+0x40/0x70 [zram]
dev_attr_show+0x28/0x80
sysfs_kf_seq_show+0x90/0x140
kernfs_seq_show+0x34/0x48
seq_read_iter+0x1d4/0x4e8
kernfs_fop_read_iter+0x40/0x58
new_sync_read+0x9c/0x168
vfs_read+0x1a8/0x1f8
ksys_read+0x74/0x108
__arm64_sys_read+0x24/0x38
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x38/0x138
el0t_64_sync_handler+0xc0/0xc8
el0t_64_sync+0x188/0x190

The zram->comp_algs[ZRAM_PRIMARY_COMP] can be NULL in zram_add() if
comp_algorithm_set() has not been called. User can access the zram device
by sysfs after device_add_disk(), so there is a time window to trigger the
NULL pointer dereference. Move it ahead device_add_disk() to make sure
when user can access the zram device, it is ready. comp_algorithm_set()
is protected by zram->init_lock in other places and no such problem.

Affected products

VendorProductAffectedFixed
Linux Linux 6.2 6.6.84

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.12.3-1 —
Debian 13 linux 6.12.3-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux 6.8.0-58.60 USN-7449-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1027.29 USN-7449-1
Ubuntu 24.04 LTS linux-azure 6.8.0-1027.32 USN-7449-1
Ubuntu 24.04 LTS linux-azure-6.11 6.11.0-1018.18~24.04.1 USN-7628-1
Ubuntu 24.04 LTS linux-azure-nvidia 6.8.0-1014.15 USN-7468-1
Ubuntu 24.04 LTS linux-gcp 6.8.0-1028.30 USN-7450-1
Ubuntu 24.04 LTS linux-gcp-6.11 6.11.0-1016.16~24.04.1 USN-7605-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1023.27 USN-7450-1
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1010.12 USN-7450-1
Ubuntu 24.04 LTS linux-hwe-6.11 6.11.0-28.28~24.04.1 USN-7605-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1024.24 USN-7449-1
Ubuntu 24.04 LTS linux-lowlatency-hwe-6.11 6.11.0-1015.16~24.04.2 USN-7605-2
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1026.29 USN-7449-1
Ubuntu 24.04 LTS linux-nvidia-6.11 6.11.0-1012.12 —
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1026.29.1 USN-7449-1
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1008.8 —
Ubuntu 24.04 LTS linux-oem-6.11 6.11.0-1024.24 USN-7606-1
Ubuntu 24.04 LTS linux-oem-6.8 6.8.0-1026.26 USN-7449-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1024.25 USN-7449-1
Ubuntu 24.04 LTS linux-raspi 6.8.0-1028.32 USN-7524-1
Ubuntu 24.04 LTS linux-realtime +1 No fix yet —
Ubuntu 24.04 LTS linux-riscv +1 6.8.0-58.60.1 USN-7449-1
Ubuntu 24.04 LTS linux-xilinx 6.8.0-1017.18 —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1027.29~22.04.1 USN-7451-1
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1027.32~22.04.1 USN-7449-1
Ubuntu 22.04 LTS linux-gcp-6.8 6.8.0-1028.30~22.04.1 USN-7452-1
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-58.60~22.04.1 USN-7449-2
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1024.24~22.04.1 —
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1026.29~22.04.1 USN-7449-1
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1024.25~22.04.1 USN-7449-1
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 22.04 LTS linux-riscv-6.8 +1 6.8.0-58.60.1~22.04.1 USN-7449-1
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2023.24 USN-7523-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1020.21 USN-7453-1
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1020.21~22.04.1 —
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-78.78+fips1 —
ReleasePackageFixed inAdvisory
RHEL 10 rv +76 6.12.0-124.8.1.el10_1 RHSA-2025:20095
RHEL 9 rv +77 5.14.0-570.12.1.el9_6 RHSA-2025:6966

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 rv +74 6.12.0-124.8.1.el10_1 ALSA-2025:20095

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 kernel 6.12.0-124.8.1.el10_1 RLSA-2025:20095
ReleasePackageFixed inAdvisory
SLES 15 SP6 kernel-64kb +6 6.4.0-150600.23.33.1 SUSE-SU-2025:0154-1
SLES 15 SP6 kernel-azure +2 6.4.0-150600.8.23.1 SUSE-SU-2025:0117-1
SLES 15 SP6 kernel-coco +3 6.4.0-15061.12.coco15sp6.1 SUSE-SU-2025:0289-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.33.1.150600.12.14.1 SUSE-SU-2025:0154-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 kernel-default-base 6.4.0-24.1.21.4 SUSE-SU-2025:20248-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_5 1-1.1 SUSE-SU-2025:20249-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_5 1-1.2 SUSE-SU-2025:20248-1
SLE Micro 6.1 kernel-rt +4 6.4.0-25.1 SUSE-SU-2025:20249-1, SUSE-SU-2025:20248-1
SLE Micro 6.0 kernel-default-base 6.4.0-24.1.21.4 SUSE-SU-2025:20165-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_5 1-1.1 SUSE-SU-2025:20166-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_5 1-1.2 SUSE-SU-2025:20165-1
SLE Micro 6.0 kernel-rt +4 6.4.0-25.1 SUSE-SU-2025:20166-1, SUSE-SU-2025:20165-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.33.1 SUSE-SU-2025:0154-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_7 1-150600.1.3.1 SUSE-SU-2025:0153-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_7 1-150600.13.3.1 SUSE-SU-2025:0154-1
SUSE Real Time Module 15 SP6 kernel-rt +3 6.4.0-150600.10.23.1 SUSE-SU-2025:0153-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 dtb-aarch64 +10 6.4.0-150600.23.33.1 SUSE-SU-2025:0154-1
openSUSE Leap 15.6 kernel-azure +2 6.4.0-150600.8.23.1 SUSE-SU-2025:0117-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.33.1.150600.12.14.1 SUSE-SU-2025:0154-1
openSUSE Leap 15.6 kernel-rt +3 6.4.0-150600.10.23.1 SUSE-SU-2025:0153-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kernel 6.6.85.1-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 bpftool 7.5.0-802.el9_6 ELSA-2025-6966
Oracle Linux 9 kernel-uek +34 6.12.0-101.33.4.3.el10uek ELSA-2025-20530, ELSA-2025-20480
Oracle Linux 9 rv +28 5.14.0-570.12.1.0.1.el9_6 ELSA-2025-6966

Advisories 30

References