CVE-2026-23177

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23177", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.983Z", "datePublished": "2026-02-14T16:27:09.429Z", "dateUpdated": "2026-05-11T22:01:48.769Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:01:48.769Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, shmem: prevent infinite loop on truncate race\n\nWhen truncating a large swap entry, shmem_free_swap() returns 0 when the\nentry's index doesn't match the given index due to lookup alignment. The\nfailure fallback path checks if the entry crosses the end border and\naborts when it happens, so truncate won't erase an unexpected entry or\nrange. But one scenario was ignored.\n\nWhen `index` points to the middle of a large swap entry, and the large\nswap entry doesn't go across the end border, find_get_entries() will\nreturn that large swap entry as the first item in the batch with\n`indices[0]` equal to `index`. The entry's base index will be smaller\nthan `indices[0]`, so shmem_free_swap() will fail and return 0 due to the\n\"base < index\" check. The code will then call shmem_confirm_swap(), get\nthe order, check if it crosses the END boundary (which it doesn't), and\nretry with the same index.\n\nThe next iteration will find the same entry again at the same index with\nsame indices, leading to an infinite loop.\n\nFix this by retrying with a round-down index, and abort if the index is\nsmaller than the truncate range."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/shmem.c"], "versions": [{"version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "lessThan": "dfc3ab6bd64860f8022d69903be299d09be86e11", "status": "affected", "versionType": "git"}, {"version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "lessThan": "7b6a0f121d50234aab3e7ab9a62ebe826d40a32a", "status": "affected", "versionType": "git"}, {"version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "lessThan": "2030dddf95451b4e7a389f052091e7c4b7b274c6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/shmem.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.70", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.10", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.70"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dfc3ab6bd64860f8022d69903be299d09be86e11"}, {"url": "https://git.kernel.org/stable/c/7b6a0f121d50234aab3e7ab9a62ebe826d40a32a"}, {"url": "https://git.kernel.org/stable/c/2030dddf95451b4e7a389f052091e7c4b7b274c6"}], "title": "mm, shmem: prevent infinite loop on truncate race", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/shmem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dfc3ab6bd64860f8022d69903be299d09be86e11", "status": "affected", "version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "versionType": "git"}, {"lessThan": "7b6a0f121d50234aab3e7ab9a62ebe826d40a32a", "status": "affected", "version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "versionType": "git"}, {"lessThan": "2030dddf95451b4e7a389f052091e7c4b7b274c6", "status": "affected", "version": "809bc86517cc408b5b8cb8e08e69096639432bc8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/shmem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.70", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, shmem: prevent infinite loop on truncate race\n\nWhen truncating a large swap entry, shmem_free_swap() returns 0 when the\nentry's index doesn't match the given index due to lookup alignment. The\nfailure fallback path checks if the entry crosses the end border and\naborts when it happens, so truncate won't erase an unexpected entry or\nrange. But one scenario was ignored.\n\nWhen `index` points to the middle of a large swap entry, and the large\nswap entry doesn't go across the end border, find_get_entries() will\nreturn that large swap entry as the first item in the batch with\n`indices[0]` equal to `index`. The entry's base index will be smaller\nthan `indices[0]`, so shmem_free_swap() will fail and return 0 due to the\n\"base < index\" check. The code will then call shmem_confirm_swap(), get\nthe order, check if it crosses the END boundary (which it doesn't), and\nretry with the same index.\n\nThe next iteration will find the same entry again at the same index with\nsame indices, leading to an infinite loop.\n\nFix this by retrying with a round-down index, and abort if the index is\nsmaller than the truncate range."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm, shmem: evitar bucle infinito en una condici\u00f3n de carrera de truncamiento\n\nAl truncar una entrada de intercambio grande, shmem_free_swap() devuelve 0 cuando el \u00edndice de la entrada no coincide con el \u00edndice dado debido a la alineaci\u00f3n de b\u00fasqueda. La ruta de retroceso en caso de fallo comprueba si la entrada cruza el borde final y aborta cuando esto ocurre, por lo que el truncamiento no borrar\u00e1 una entrada o rango inesperado. Pero un escenario fue ignorado.\n\nCuando 'index' apunta al medio de una entrada de intercambio grande, y la entrada de intercambio grande no cruza el borde final, find_get_entries() devolver\u00e1 esa entrada de intercambio grande como el primer elemento en el lote con 'indices[0]' igual a 'index'. El \u00edndice base de la entrada ser\u00e1 menor que 'indices[0]', por lo que shmem_free_swap() fallar\u00e1 y devolver\u00e1 0 debido a la comprobaci\u00f3n \"base &lt; index\". El c\u00f3digo entonces llamar\u00e1 a shmem_confirm_swap(), obtendr\u00e1 el orden, comprobar\u00e1 si cruza el l\u00edmite END (lo cual no hace), y reintentar\u00e1 con el mismo \u00edndice.\n\nLa siguiente iteraci\u00f3n encontrar\u00e1 la misma entrada de nuevo en el mismo \u00edndice con los mismos \u00edndices, lo que lleva a un bucle infinito.\n\nSolucione esto reintentando con un \u00edndice redondeado a la baja, y abortar si el \u00edndice es menor que el rango de truncamiento."}], "id": "CVE-2026-23177", "lastModified": "2026-06-17T10:21:02.663", "metrics": {}, "published": "2026-02-14T17:15:55.430", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2030dddf95451b4e7a389f052091e7c4b7b274c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7b6a0f121d50234aab3e7ab9a62ebe826d40a32a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dfc3ab6bd64860f8022d69903be299d09be86e11"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: mm, shmem: prevent infinite loop on truncate race", "id": "2439929", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439929"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm, shmem: prevent infinite loop on truncate race\nWhen truncating a large swap entry, shmem_free_swap() returns 0 when the\nentry's index doesn't match the given index due to lookup alignment. The\nfailure fallback path checks if the entry crosses the end border and\naborts when it happens, so truncate won't erase an unexpected entry or\nrange. But one scenario was ignored.\nWhen `index` points to the middle of a large swap entry, and the large\nswap entry doesn't go across the end border, find_get_entries() will\nreturn that large swap entry as the first item in the batch with\n`indices[0]` equal to `index`. The entry's base index will be smaller\nthan `indices[0]`, so shmem_free_swap() will fail and return 0 due to the\n\"base < index\" check. The code will then call shmem_confirm_swap(), get\nthe order, check if it crosses the END boundary (which it doesn't), and\nretry with the same index.\nThe next iteration will find the same entry again at the same index with\nsame indices, leading to an infinite loop.\nFix this by retrying with a round-down index, and abort if the index is\nsmaller than the truncate range."], "name": "CVE-2026-23177", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23177\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23177\nhttps://lore.kernel.org/linux-cve-announce/2026021428-CVE-2026-23177-a343@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[809bc86517cc408b5b8cb8e08e69096639432bc8,dfc3ab6bd64860f8022d69903be299d09be86e11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[809bc86517cc408b5b8cb8e08e69096639432bc8,7b6a0f121d50234aab3e7ab9a62ebe826d40a32a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[809bc86517cc408b5b8cb8e08e69096639432bc8,2030dddf95451b4e7a389f052091e7c4b7b274c6)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.70,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.10,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-18T12:16:11.444945+00:00", "value": {"mitigation_remediation": ["Apply a kernel patch that includes the retry logic fix for shmem_free_swap \u2013 update to a kernel version that contains the applied commit.", "Reboot the system to load the new kernel image and ensure the patch takes effect.", "Ensure all hosts in the environment run the patched kernel, especially those providing virtualized or containerized services that rely on the kernel."], "summary": {"action": "Patch immediately", "impact": "Denial of Service via infinite loop in swap truncation"}, "threat_synthesis": {"affected_systems": "All Linux kernel releases that contain the unpatched shmem module are impacted. Vendors listed as \"Linux:Linux\" in the CNA data reflect that the issue exists in the upstream kernel itself, so any distribution kernel that ships the vulnerable version without the patch is affected. Exact version ranges are not specified, but the fix was introduced by applying the commit that adds retry logic with a round\u2011down index. Users running kernel versions prior to this change, irrespective of distribution, are at risk.", "description_and_impact": "The vulnerability resides in the Linux kernel memory\u2011management subsystem. When a large swap entry is truncated, the routine that frees the swap entry can incorrectly re\u2011enter the truncation loop if the requested index falls in the middle of that entry. This logic flaw causes the kernel to repeat the same lookup and retry, resulting in an infinite loop that consumes processor time and stalls the truncation operation. The effect is a denial of service condition: the process initiating the truncation can be starved of CPU resources, potentially affecting system responsiveness. No privilege escalation or data disclosure is possible from this flaw, but it can be leveraged by a local user with sufficient rights to manipulate swap entries.", "risk_and_exploitability": "The CVSS score of 7.0 indicates a moderate to high severity, while the EPSS score is below 1%, suggesting a low likelihood of public exploitation at this time. The vulnerability is not listed in CISA\u2019s KEV catalog, further supporting the low current threat level. Exploitation requires a local context, typically a user with permission to truncate large swap entries, which may be limited to privileged users or root. Given the straightforward nature of the bug once the relevant code path is invoked, an attacker with local control could trigger a denial of service by repeatedly attempting to truncate swap entries, leading to persistent CPU hogging until the operation is aborted by the kernel."}}}}, "created": "2026-02-16T09:44:00.775709+00:00", "updated": "2026-04-18T12:30:45.446546+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-668"]}