CVE-2026-23161

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23161", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.979Z", "datePublished": "2026-02-14T16:01:26.569Z", "dateUpdated": "2026-08-05T12:20:23.871Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:23.871Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix race of truncate and swap entry split\n\nThe helper for shmem swap freeing is not handling the order of swap\nentries correctly. It uses xa_cmpxchg_irq to erase the swap entry, but it\ngets the entry order before that using xa_get_order without lock\nprotection, and it may get an outdated order value if the entry is split\nor changed in other ways after the xa_get_order and before the\nxa_cmpxchg_irq.\n\nAnd besides, the order could grow and be larger than expected, and cause\ntruncation to erase data beyond the end border. For example, if the\ntarget entry and following entries are swapped in or freed, then a large\nfolio was added in place and swapped out, using the same entry, the\nxa_cmpxchg_irq will still succeed, it's very unlikely to happen though.\n\nTo fix that, open code the Xarray cmpxchg and put the order retrieval and\nvalue checking in the same critical section. Also, ensure the order won't\nexceed the end border, skip it if the entry goes across the border.\n\nSkipping large swap entries crosses the end border is safe here. Shmem\ntruncate iterates the range twice, in the first iteration,\nfind_lock_entries already filtered such entries, and shmem will swapin the\nentries that cross the end border and partially truncate the folio (split\nthe folio or at least zero part of it). So in the second loop here, if we\nsee a swap entry that crosses the end order, it must at least have its\ncontent erased already.\n\nI observed random swapoff hangs and kernel panics when stress testing\nZSWAP with shmem. After applying this patch, all problems are gone."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is in shmem/tmpfs truncation code, reachable through local syscalls (ftruncate, fallocate, truncate) on tmpfs or memfd files. No network path exists.\nAC:L - The attacker controls both sides of the race \u2014 one thread performs truncation while another triggers large folio swap-out that changes the entry order. The race is repeatable and the attacker creates the conditions.\nPR:L - Any unprivileged local user can create shmem/tmpfs files via memfd_create() or /dev/shm and perform truncate/fallocate operations on them. No special privileges required.\nUI:N - No user interaction is needed. The attacker independently creates the race condition by performing concurrent operations on their own shmem files.\nS:U - The vulnerability operates within the kernel's own security authority. There is no crossing of a virtualization or sandbox boundary.\nC:L - Freed swap entries could be reused by other processes, and subsequent swapin of the original file pages could read stale or foreign data, but this is an indirect and limited information leak path.\nI:H - The bug causes truncation to erase data beyond the intended border by freeing swap entries that shouldn't be freed, directly corrupting file data integrity.\nA:H - The commit author directly observed kernel panics and swapoff hangs during stress testing. The incorrect swap entry freeing causes crashes and system hangs."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/shmem.c"], "versions": [{"version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "lessThan": "a99f9a4669a04662c8f9efe0e62cafc598153139", "status": "affected", "versionType": "git"}, {"version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "lessThan": "b23bee8cdb7aabce5701a7f57414db5a354ae8ed", "status": "affected", "versionType": "git"}, {"version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "lessThan": "8a1968bd997f45a9b11aefeabdd1232e1b6c7184", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/shmem.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.69", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.9", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.69"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a99f9a4669a04662c8f9efe0e62cafc598153139"}, {"url": "https://git.kernel.org/stable/c/b23bee8cdb7aabce5701a7f57414db5a354ae8ed"}, {"url": "https://git.kernel.org/stable/c/8a1968bd997f45a9b11aefeabdd1232e1b6c7184"}], "title": "mm/shmem, swap: fix race of truncate and swap entry split", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/shmem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a99f9a4669a04662c8f9efe0e62cafc598153139", "status": "affected", "version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "versionType": "git"}, {"lessThan": "b23bee8cdb7aabce5701a7f57414db5a354ae8ed", "status": "affected", "version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "versionType": "git"}, {"lessThan": "8a1968bd997f45a9b11aefeabdd1232e1b6c7184", "status": "affected", "version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/shmem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.69", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "99E9F57D-2677-42E9-A3C5-5657D35646BA", "versionEndExcluding": "6.12.69", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "171CFCB2-8F49-4F9E-8A67-FAC6BF45B5A2", "versionEndExcluding": "6.18.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix race of truncate and swap entry split\n\nThe helper for shmem swap freeing is not handling the order of swap\nentries correctly. It uses xa_cmpxchg_irq to erase the swap entry, but it\ngets the entry order before that using xa_get_order without lock\nprotection, and it may get an outdated order value if the entry is split\nor changed in other ways after the xa_get_order and before the\nxa_cmpxchg_irq.\n\nAnd besides, the order could grow and be larger than expected, and cause\ntruncation to erase data beyond the end border. For example, if the\ntarget entry and following entries are swapped in or freed, then a large\nfolio was added in place and swapped out, using the same entry, the\nxa_cmpxchg_irq will still succeed, it's very unlikely to happen though.\n\nTo fix that, open code the Xarray cmpxchg and put the order retrieval and\nvalue checking in the same critical section. Also, ensure the order won't\nexceed the end border, skip it if the entry goes across the border.\n\nSkipping large swap entries crosses the end border is safe here. Shmem\ntruncate iterates the range twice, in the first iteration,\nfind_lock_entries already filtered such entries, and shmem will swapin the\nentries that cross the end border and partially truncate the folio (split\nthe folio or at least zero part of it). So in the second loop here, if we\nsee a swap entry that crosses the end order, it must at least have its\ncontent erased already.\n\nI observed random swapoff hangs and kernel panics when stress testing\nZSWAP with shmem. After applying this patch, all problems are gone."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nmm/shmem, swap: corrige la condici\u00f3n de carrera entre el truncamiento y la divisi\u00f3n de entradas de swap\n\nLa funci\u00f3n auxiliar para la liberaci\u00f3n de swap de shmem no est\u00e1 manejando correctamente el orden de las entradas de swap. Utiliza xa_cmpxchg_irq para borrar la entrada de swap, pero obtiene el orden de la entrada antes de eso usando xa_get_order sin protecci\u00f3n de bloqueo, y puede obtener un valor de orden obsoleto si la entrada se divide o cambia de otras maneras despu\u00e9s de xa_get_order y antes de xa_cmpxchg_irq.\n\nY adem\u00e1s, el orden podr\u00eda crecer y ser mayor de lo esperado, y causar que el truncamiento borre datos m\u00e1s all\u00e1 del l\u00edmite final. Por ejemplo, si la entrada objetivo y las entradas siguientes se intercambian (swap in) o se liberan, y luego se a\u00f1adi\u00f3 un folio grande en su lugar y se intercambi\u00f3 (swap out), usando la misma entrada, el xa_cmpxchg_irq seguir\u00e1 teniendo \u00e9xito, aunque es muy poco probable que ocurra.\n\nPara solucionar eso, se implementa directamente el cmpxchg de Xarray y se coloca la recuperaci\u00f3n del orden y la verificaci\u00f3n del valor en la misma secci\u00f3n cr\u00edtica. Adem\u00e1s, se asegura que el orden no exceda el l\u00edmite final, se omite si la entrada cruza el l\u00edmite.\n\nOmitir entradas de swap grandes que cruzan el l\u00edmite final es seguro aqu\u00ed. El truncamiento de shmem itera el rango dos veces; en la primera iteraci\u00f3n, find_lock_entries ya filtr\u00f3 dichas entradas, y shmem intercambiar\u00e1 (swap in) las entradas que cruzan el l\u00edmite final y truncar\u00e1 parcialmente el folio (dividir\u00e1 el folio o al menos pondr\u00e1 a cero parte de \u00e9l). As\u00ed que, en el segundo bucle aqu\u00ed, si vemos una entrada de swap que cruza el orden final, al menos ya debe tener su contenido borrado.\n\nObserv\u00e9 bloqueos aleatorios de swapoff y 'kernel panics' al realizar pruebas de estr\u00e9s de ZSWAP con shmem. Despu\u00e9s de aplicar este parche, todos los problemas desaparecieron."}], "id": "CVE-2026-23161", "lastModified": "2026-06-17T10:21:00.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-14T16:15:56.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8a1968bd997f45a9b11aefeabdd1232e1b6c7184"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a99f9a4669a04662c8f9efe0e62cafc598153139"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b23bee8cdb7aabce5701a7f57414db5a354ae8ed"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm/shmem, swap: fix race of truncate and swap entry split", "id": "2439921", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439921"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23161", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23161\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23161\nhttps://lore.kernel.org/linux-cve-announce/2026021418-CVE-2026-23161-d727@gregkh/T"], "statement": "This race condition requires specific timing between truncate operations and swap entry splits under ZSWAP stress. While it can cause kernel panics, it's difficult to trigger reliably and primarily affects systems using ZSWAP with shmem/tmpfs under heavy memory pressure. No data confidentiality or integrity impact beyond the crash.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[809bc86517cc408b5b8cb8e08e69096639432bc8,a99f9a4669a04662c8f9efe0e62cafc598153139)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[809bc86517cc408b5b8cb8e08e69096639432bc8,b23bee8cdb7aabce5701a7f57414db5a354ae8ed)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[809bc86517cc408b5b8cb8e08e69096639432bc8,8a1968bd997f45a9b11aefeabdd1232e1b6c7184)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.69,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.9,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-18T18:02:58.011360+00:00", "value": {"mitigation_remediation": ["Upgrade to a patched Linux kernel release (e.g., 6.19 rc8 or newer) that incorporates the race\u2011condition fix.", "If an upgrade is not immediately feasible, disable ZSWAP or set vm.swappiness=0 to reduce use of shmem swap and lower the attack surface.", "Monitor system logs (dmesg, journalctl) for swapoff hangs or kernel panics and consider applying SELinux/AppArmor profiles to harden the runtime environment."], "summary": {"action": "Apply Patch", "impact": "Kernel memory corruption or kernel panic leading to denial of service"}, "threat_synthesis": {"affected_systems": "The flaw exists in the Linux kernel itself, specifically in versions 6.19 release candidates rc1 through rc7. Systems running these kernels and utilizing the shmem swap facility are potentially vulnerable.", "description_and_impact": "The Linux kernel\u2019s memory\u2011management subsystem contains a race condition in the shared\u2011memory (shmem) swap\u2011freeing routine. The helper obtains the order of a swap entry with xa_get_order outside a lock and later performs an atomic compare\u2011and\u2011swap to delete the entry. If the entry is split or otherwise modified between these two steps, the order value becomes stale. The stale order can cause the helper to truncate data beyond the intended end boundary or leave a swap entry uncleared, resulting in kernel memory corruption and potentially a panic when swapoff is called.", "risk_and_exploitability": "The CVSS score of 7.3 indicates a high\u2011severity impact. The EPSS score is reported as <\u202f1\u202f% and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require a precise race between truncation of a region and modification of a swap entry; such a race is technically possible but practically difficult to trigger from user space. The risk is therefore primarily a denial\u2011of\u2011service scenario rather than privilege escalation."}}}}, "created": "2026-02-16T12:01:06.599559+00:00", "updated": "2026-04-18T18:15:06.575286+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}