{
  "cveId": "CVE-2026-63951",
  "url": "https://patchblox.com/security/cve/CVE-2026-63951",
  "summary": "CVE-2026-63951 is fixed in linux on 1 platform by DEBIAN-CVE-2026-63951 (version 7.0.12-1), released July 20, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  zram: fix use-after-free in zram_writeback_endio...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  zram: fix use-after-free in zram_writeback_endio  A crash was observed in zram_writeback_endio due to a NULL pointer dereference in wake_up.  The root cause is a race condition between the bio completion handler (zram_writeback_endio) and the writeback task.  In zram_writeback_endio, wake_up() is called on \u0026wb_ctl-\u003Edone_wait after releasing wb_ctl-\u003Edone_lock.  This creates a race window where the writeback task can see num_inflight become 0, return, and free wb_ctl before zram_writeback_endio calls wake_up().  CPU 0 (zram_writeback_endio)     CPU 1 (writeback_store) ============================     ============================                                  zram_writeback_slots                                    zram_submit_wb_request                                    zram_submit_wb_request                                    wait_event(wb_ctl-\u003Edone_wait) spin_lock(\u0026wb_ctl-\u003Edone_lock); list_add(\u0026req-\u003Eentry, \u0026wb_ctl-\u003Edone_reqs); spin_unlock(\u0026wb_ctl-\u003Edone_lock); wake_up(\u0026wb_ctl-\u003Edone_wait);                                    zram_complete_done_reqs spin_lock(\u0026wb_ctl-\u003Edone_lock); list_add(\u0026req-\u003Eentry, \u0026wb_ctl-\u003Edone_reqs); spin_unlock(\u0026wb_ctl-\u003Edone_lock);                                    while (num_inflight) \u003E 0)                                      spin_lock(\u0026wb_ctl-\u003Edone_lock);                                      list_del(\u0026req-\u003Eentry);                                      spin_unlock(\u0026wb_ctl-\u003Edone_lock);                                      // num_inflight becomes 0                                      atomic_dec(num_inflight);                                   // Leave zram_writeback_slots                                  // Free wb_ctl                                  release_wb_ctl(wb_ctl); // UAF crash! wake_up(\u0026wb_ctl-\u003Edone_wait);  This patch fixes this race by using RCU.  By protecting wb_ctl with rcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it, we ensure that wb_ctl remains valid during the execution of zram_writeback_endio.",
  "published": "2026-07-19T16:17:13Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00177,
  "epssPercentile": 0.07295,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.0.12-1",
      "fix": "DEBIAN-CVE-2026-63951",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-63951",
      "released": "2026-07-20T12:58:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-11T01:43:54Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}