CVE-2026-89552

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

params: fix charp corruption on allocation failure

param_set_charp() stores charp parameters in allocated memory after slab is

available, and releases the previous value when the parameter is updated.

The previous value is released before the replacement allocation succeeds.

If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter

left as NULL.

Failing zswap's compressor update before zswap is initialized can later

trigger:

BUG: kernel NULL pointer dereference, address: 0000000000000000

RIP: 0010:strcmp+0x10/0x30

Call Trace:

zswap_setup+0x3b1/0x490

zswap_enabled_param_set+0x5b/0xa0

param_attr_store+0x93/0xe0

module_attr_store+0x1c/0x30

kernfs_fop_write_iter+0x116/0x1f0

Allocate and copy the replacement first, then replace the parameter value

only after allocation succeeds.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References