Message-ID: <2026021418-CVE-2026-23161-d727@gregkh>
Date: Sat, 14 Feb 2026 17:04:27 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mm/shmem, swap: fix race of truncate and swap entry split

The helper for shmem swap freeing is not handling the order of swap
entries correctly.  It uses xa_cmpxchg_irq to erase the swap entry, but it
gets the entry order before that using xa_get_order without lock
protection, and it may get an outdated order value if the entry is split
or changed in other ways after the xa_get_order and before the
xa_cmpxchg_irq.

And besides, the order could grow and be larger than expected, and cause
truncation to erase data beyond the end border.  For example, if the
target entry and following entries are swapped in or freed, then a large
folio was added in place and swapped out, using the same entry, the
xa_cmpxchg_irq will still succeed, it's very unlikely to happen though.

To fix that, open code the Xarray cmpxchg and put the order retrieval and
value checking in the same critical section.  Also, ensure the order won't
exceed the end border, skip it if the entry goes across the border.

Skipping large swap entries crosses the end border is safe here.  Shmem
truncate iterates the range twice, in the first iteration,
find_lock_entries already filtered such entries, and shmem will swapin the
entries that cross the end border and partially truncate the folio (split
the folio or at least zero part of it).  So in the second loop here, if we
see a swap entry that crosses the end order, it must at least have its
content erased already.

I observed random swapoff hangs and kernel panics when stress testing
ZSWAP with shmem.  After applying this patch, all problems are gone.

The Linux kernel CVE team has assigned CVE-2026-23161 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 809bc86517cc408b5b8cb8e08e69096639432bc8 and fixed in 6.12.69 with commit a99f9a4669a04662c8f9efe0e62cafc598153139
	Issue introduced in 6.12 with commit 809bc86517cc408b5b8cb8e08e69096639432bc8 and fixed in 6.18.9 with commit b23bee8cdb7aabce5701a7f57414db5a354ae8ed
	Issue introduced in 6.12 with commit 809bc86517cc408b5b8cb8e08e69096639432bc8 and fixed in 6.19 with commit 8a1968bd997f45a9b11aefeabdd1232e1b6c7184

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-23161
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	mm/shmem.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a99f9a4669a04662c8f9efe0e62cafc598153139
	https://git.kernel.org/stable/c/b23bee8cdb7aabce5701a7f57414db5a354ae8ed
	https://git.kernel.org/stable/c/8a1968bd997f45a9b11aefeabdd1232e1b6c7184

Powered by blists - more mailing lists