{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23161", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.979Z", "datePublished": "2026-02-14T16:01:26.569Z", "dateUpdated": "2026-08-05T12:20:23.871Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:23.871Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix race of truncate and swap entry split\n\nThe helper for shmem swap freeing is not handling the order of swap\nentries correctly. It uses xa_cmpxchg_irq to erase the swap entry, but it\ngets the entry order before that using xa_get_order without lock\nprotection, and it may get an outdated order value if the entry is split\nor changed in other ways after the xa_get_order and before the\nxa_cmpxchg_irq.\n\nAnd besides, the order could grow and be larger than expected, and cause\ntruncation to erase data beyond the end border. For example, if the\ntarget entry and following entries are swapped in or freed, then a large\nfolio was added in place and swapped out, using the same entry, the\nxa_cmpxchg_irq will still succeed, it's very unlikely to happen though.\n\nTo fix that, open code the Xarray cmpxchg and put the order retrieval and\nvalue checking in the same critical section. Also, ensure the order won't\nexceed the end border, skip it if the entry goes across the border.\n\nSkipping large swap entries crosses the end border is safe here. Shmem\ntruncate iterates the range twice, in the first iteration,\nfind_lock_entries already filtered such entries, and shmem will swapin the\nentries that cross the end border and partially truncate the folio (split\nthe folio or at least zero part of it). So in the second loop here, if we\nsee a swap entry that crosses the end order, it must at least have its\ncontent erased already.\n\nI observed random swapoff hangs and kernel panics when stress testing\nZSWAP with shmem. After applying this patch, all problems are gone." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is in shmem/tmpfs truncation code, reachable through local syscalls (ftruncate, fallocate, truncate) on tmpfs or memfd files. No network path exists.\nAC:L - The attacker controls both sides of the race — one thread performs truncation while another triggers large folio swap-out that changes the entry order. The race is repeatable and the attacker creates the conditions.\nPR:L - Any unprivileged local user can create shmem/tmpfs files via memfd_create() or /dev/shm and perform truncate/fallocate operations on them. No special privileges required.\nUI:N - No user interaction is needed. The attacker independently creates the race condition by performing concurrent operations on their own shmem files.\nS:U - The vulnerability operates within the kernel's own security authority. There is no crossing of a virtualization or sandbox boundary.\nC:L - Freed swap entries could be reused by other processes, and subsequent swapin of the original file pages could read stale or foreign data, but this is an indirect and limited information leak path.\nI:H - The bug causes truncation to erase data beyond the intended border by freeing swap entries that shouldn't be freed, directly corrupting file data integrity.\nA:H - The commit author directly observed kernel panics and swapoff hangs during stress testing. The incorrect swap entry freeing causes crashes and system hangs." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/shmem.c" ], "versions": [ { "version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "lessThan": "a99f9a4669a04662c8f9efe0e62cafc598153139", "status": "affected", "versionType": "git" }, { "version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "lessThan": "b23bee8cdb7aabce5701a7f57414db5a354ae8ed", "status": "affected", "versionType": "git" }, { "version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "lessThan": "8a1968bd997f45a9b11aefeabdd1232e1b6c7184", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/shmem.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.69", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.9", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.69" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a99f9a4669a04662c8f9efe0e62cafc598153139" }, { "url": "https://git.kernel.org/stable/c/b23bee8cdb7aabce5701a7f57414db5a354ae8ed" }, { "url": "https://git.kernel.org/stable/c/8a1968bd997f45a9b11aefeabdd1232e1b6c7184" } ], "title": "mm/shmem, swap: fix race of truncate and swap entry split", "x_generator": { "engine": "bippy-1.2.0" } } } }