linux-cve-announce - CVE-2026-23177: mm, shmem: prevent infinite loop on truncate race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026021428-CVE-2026-23177-a343@gregkh>
Date: Sat, 14 Feb 2026 17:28:34 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2026-23177: mm, shmem: prevent infinite loop on truncate race

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mm, shmem: prevent infinite loop on truncate race

When truncating a large swap entry, shmem_free_swap() returns 0 when the
entry's index doesn't match the given index due to lookup alignment.  The
failure fallback path checks if the entry crosses the end border and
aborts when it happens, so truncate won't erase an unexpected entry or
range.  But one scenario was ignored.

When `index` points to the middle of a large swap entry, and the large
swap entry doesn't go across the end border, find_get_entries() will
return that large swap entry as the first item in the batch with
`indices[0]` equal to `index`.  The entry's base index will be smaller
than `indices[0]`, so shmem_free_swap() will fail and return 0 due to the
"base < index" check.  The code will then call shmem_confirm_swap(), get
the order, check if it crosses the END boundary (which it doesn't), and
retry with the same index.

The next iteration will find the same entry again at the same index with
same indices, leading to an infinite loop.

Fix this by retrying with a round-down index, and abort if the index is
smaller than the truncate range.

The Linux kernel CVE team has assigned CVE-2026-23177 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 809bc86517cc408b5b8cb8e08e69096639432bc8 and fixed in 6.12.70 with commit dfc3ab6bd64860f8022d69903be299d09be86e11
	Issue introduced in 6.12 with commit 809bc86517cc408b5b8cb8e08e69096639432bc8 and fixed in 6.18.10 with commit 7b6a0f121d50234aab3e7ab9a62ebe826d40a32a
	Issue introduced in 6.12 with commit 809bc86517cc408b5b8cb8e08e69096639432bc8 and fixed in 6.19 with commit 2030dddf95451b4e7a389f052091e7c4b7b274c6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-23177
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	mm/shmem.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/dfc3ab6bd64860f8022d69903be299d09be86e11
	https://git.kernel.org/stable/c/7b6a0f121d50234aab3e7ab9a62ebe826d40a32a
	https://git.kernel.org/stable/c/2030dddf95451b4e7a389f052091e7c4b7b274c6