CVE-2026-98818

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98818", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.371Z", "datePublished": "2026-10-18T15:49:10.258Z", "dateUpdated": "2026-10-19T09:26:11.267Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:26:11.267Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: do not wake up kswapd in __kfree_rcu_sheaf()\n\nSince kfree_rcu() can be called under pi_lock (a raw spinlock in the\nscheduler), kfree_rcu() itself should never allocate memory with\n__GFP_KSWAPD_RECLAIM as waking up kswapd ends up acquiring pi_lock,\nwhich leads to a deadlock.\n\nReproducing the issue even intentionally was not straightforward.\nThe set_cpus_allowed_force() path that is called under pi_lock is\nexercised very rarely, and competing tasks that allocate memory will\nmost likely wake kswapd up.\n\nTherefore the existence of the deadlock was verified with a modified\nkernel that has a lockdep map for waking up kswapd:\n\n ======================================================\n WARNING: possible circular locking dependency detected\n 7.2.0-rc1-slab-for-next+ #10 Not tainted\n ------------------------------------------------------\n git/6660 is trying to acquire lock:\n ffff8e524533c550 (&p->pi_lock){-.-.}-{2:2}, at: _raw_spin_lock_irqsave+0x12/0x20\n\n but task is already holding lock:\n ffff8e57bffff1a0 (&pgdat->kswapd_wait){....}-{3:3}, at: _raw_spin_lock_irqsave+0x12/0x20\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -> #2 (&pgdat->kswapd_wait){....}-{3:3}:\n __lock_acquire+0x5a4/0xc50\n lock_acquire.part.0+0xb7/0x240\n lock_acquire+0x70/0x170\n __raw_spin_lock_irqsave+0x44/0x80\n _raw_spin_lock_irqsave+0x12/0x20\n __wake_up_common_lock+0x31/0xa0\n __wake_up+0x20/0x40\n kswapd_wakeup_wake+0x7e/0x110\n wakeup_kswapd+0x295/0x320\n wake_all_kswapds+0xac/0x1a0\n __alloc_pages_slowpath.constprop.0+0x282/0xf80\n __alloc_frozen_pages_noprof+0x32a/0x360\n alloc_slab_page+0x2e/0x160\n allocate_slab+0x82/0x420\n new_slab+0x52/0xb0\n refill_objects+0x13d/0x190\n refill_sheaf+0x5d/0xd0\n __pcs_replace_empty_main+0x230/0xb10\n [...]\n\n -> #1 (kswapd_wakeup){-.-.}-{0:0}:\n __lock_acquire+0x5a4/0xc50\n lock_sync.part.0+0x75/0x100\n lock_sync+0x36/0x70\n might_wakeup_kswapd+0x61/0xa0\n __kfree_rcu_sheaf+0x33/0xd90\n kvfree_call_rcu+0x1d4/0x3b0\n set_cpus_allowed_force+0x163/0x220\n cpuset_cpus_allowed_fallback+0x18b/0x240\n select_fallback_rq+0x1e6/0x250\n\t [...]\n\n -> #0 (&p->pi_lock){-.-.}-{2:2}:\n check_prev_add+0xe6/0xe00\n validate_chain+0x51e/0x6e0\n __lock_acquire+0x5a4/0xc50\n lock_acquire.part.0+0xb7/0x240\n lock_acquire+0x70/0x170\n __raw_spin_lock_irqsave+0x44/0x80\n _raw_spin_lock_irqsave+0x12/0x20\n try_to_wake_up+0x77/0xa90\n default_wake_function+0x27/0x60\n autoremove_wake_function+0x23/0xb0\n __wake_up_common+0xb8/0x170\n __wake_up_common_lock+0x51/0xa0\n __wake_up+0x20/0x40\n kswapd_wakeup_wake+0x7e/0x110\n wakeup_kswapd+0x295/0x320\n wake_all_kswapds+0xac/0x1a0\n __alloc_pages_slowpath.constprop.0+0x282/0xf80\n __alloc_frozen_pages_noprof+0x32a/0x360\n alloc_slab_page+0x2e/0x160\n allocate_slab+0x82/0x420\n new_slab+0x52/0xb0\n refill_objects+0x13d/0x190\n refill_sheaf+0x5d/0xd0\n __pcs_replace_empty_main+0x230/0xb10\n [...]\n\n other info that might help us debug this:\n\n Chain exists of:\n &p->pi_lock --> kswapd_wakeup --> &pgdat->kswapd_wait\n\n Possible unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n lock(&pgdat->kswapd_wait);\n lock(kswapd_wakeup);\n lock(&pgdat->kswapd_wait);\n lock(&p->pi_lock);\n\n *** DEADLOCK ***\n\n 3 locks held by git/6660:\n #0: ffff8e519f0e9e20 (&type->i_mutex_dir_key#6){++++}-{4:4}, at: lookup_slow+0x2d/0x60\n #1: ffffffff8a31c460 (kswapd_wakeup){-.-.}-\n---truncated---"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/slub.c"], "versions": [{"version": "ec66e0d599520ab414db745544e25d80d0ac5054", "lessThan": "46545c86b54ffb969b6e3662942b4a6191619eaa", "status": "affected", "versionType": "git"}, {"version": "ec66e0d599520ab414db745544e25d80d0ac5054", "lessThan": "af2fb3ee6679b517e2fdbd3ba16ec276a8b74312", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/slub.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/46545c86b54ffb969b6e3662942b4a6191619eaa"}, {"url": "https://git.kernel.org/stable/c/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312"}], "title": "mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/slub.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "46545c86b54ffb969b6e3662942b4a6191619eaa", "status": "affected", "version": "ec66e0d599520ab414db745544e25d80d0ac5054", "versionType": "git"}, {"lessThan": "af2fb3ee6679b517e2fdbd3ba16ec276a8b74312", "status": "affected", "version": "ec66e0d599520ab414db745544e25d80d0ac5054", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/slub.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: do not wake up kswapd in __kfree_rcu_sheaf()\n\nSince kfree_rcu() can be called under pi_lock (a raw spinlock in the\nscheduler), kfree_rcu() itself should never allocate memory with\n__GFP_KSWAPD_RECLAIM as waking up kswapd ends up acquiring pi_lock,\nwhich leads to a deadlock.\n\nReproducing the issue even intentionally was not straightforward.\nThe set_cpus_allowed_force() path that is called under pi_lock is\nexercised very rarely, and competing tasks that allocate memory will\nmost likely wake kswapd up.\n\nTherefore the existence of the deadlock was verified with a modified\nkernel that has a lockdep map for waking up kswapd:\n\n ======================================================\n WARNING: possible circular locking dependency detected\n 7.2.0-rc1-slab-for-next+ #10 Not tainted\n ------------------------------------------------------\n git/6660 is trying to acquire lock:\n ffff8e524533c550 (&p->pi_lock){-.-.}-{2:2}, at: _raw_spin_lock_irqsave+0x12/0x20\n\n but task is already holding lock:\n ffff8e57bffff1a0 (&pgdat->kswapd_wait){....}-{3:3}, at: _raw_spin_lock_irqsave+0x12/0x20\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -> #2 (&pgdat->kswapd_wait){....}-{3:3}:\n __lock_acquire+0x5a4/0xc50\n lock_acquire.part.0+0xb7/0x240\n lock_acquire+0x70/0x170\n __raw_spin_lock_irqsave+0x44/0x80\n _raw_spin_lock_irqsave+0x12/0x20\n __wake_up_common_lock+0x31/0xa0\n __wake_up+0x20/0x40\n kswapd_wakeup_wake+0x7e/0x110\n wakeup_kswapd+0x295/0x320\n wake_all_kswapds+0xac/0x1a0\n __alloc_pages_slowpath.constprop.0+0x282/0xf80\n __alloc_frozen_pages_noprof+0x32a/0x360\n alloc_slab_page+0x2e/0x160\n allocate_slab+0x82/0x420\n new_slab+0x52/0xb0\n refill_objects+0x13d/0x190\n refill_sheaf+0x5d/0xd0\n __pcs_replace_empty_main+0x230/0xb10\n [...]\n\n -> #1 (kswapd_wakeup){-.-.}-{0:0}:\n __lock_acquire+0x5a4/0xc50\n lock_sync.part.0+0x75/0x100\n lock_sync+0x36/0x70\n might_wakeup_kswapd+0x61/0xa0\n __kfree_rcu_sheaf+0x33/0xd90\n kvfree_call_rcu+0x1d4/0x3b0\n set_cpus_allowed_force+0x163/0x220\n cpuset_cpus_allowed_fallback+0x18b/0x240\n select_fallback_rq+0x1e6/0x250\n\t [...]\n\n -> #0 (&p->pi_lock){-.-.}-{2:2}:\n check_prev_add+0xe6/0xe00\n validate_chain+0x51e/0x6e0\n __lock_acquire+0x5a4/0xc50\n lock_acquire.part.0+0xb7/0x240\n lock_acquire+0x70/0x170\n __raw_spin_lock_irqsave+0x44/0x80\n _raw_spin_lock_irqsave+0x12/0x20\n try_to_wake_up+0x77/0xa90\n default_wake_function+0x27/0x60\n autoremove_wake_function+0x23/0xb0\n __wake_up_common+0xb8/0x170\n __wake_up_common_lock+0x51/0xa0\n __wake_up+0x20/0x40\n kswapd_wakeup_wake+0x7e/0x110\n wakeup_kswapd+0x295/0x320\n wake_all_kswapds+0xac/0x1a0\n __alloc_pages_slowpath.constprop.0+0x282/0xf80\n __alloc_frozen_pages_noprof+0x32a/0x360\n alloc_slab_page+0x2e/0x160\n allocate_slab+0x82/0x420\n new_slab+0x52/0xb0\n refill_objects+0x13d/0x190\n refill_sheaf+0x5d/0xd0\n __pcs_replace_empty_main+0x230/0xb10\n [...]\n\n other info that might help us debug this:\n\n Chain exists of:\n &p->pi_lock --> kswapd_wakeup --> &pgdat->kswapd_wait\n\n Possible unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n lock(&pgdat->kswapd_wait);\n lock(kswapd_wakeup);\n lock(&pgdat->kswapd_wait);\n lock(&p->pi_lock);\n\n *** DEADLOCK ***\n\n 3 locks held by git/6660:\n #0: ffff8e519f0e9e20 (&type->i_mutex_dir_key#6){++++}-{4:4}, at: lookup_slow+0x2d/0x60\n #1: ffffffff8a31c460 (kswapd_wakeup){-.-.}-\n---truncated---"}], "id": "CVE-2026-98818", "lastModified": "2026-10-19T10:19:45.873", "metrics": {}, "published": "2026-10-18T16:17:36.017", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46545c86b54ffb969b6e3662942b4a6191619eaa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()", "id": "2555208", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555208"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm/slab: do not wake up kswapd in __kfree_rcu_sheaf()\nSince kfree_rcu() can be called under pi_lock (a raw spinlock in the\nscheduler), kfree_rcu() itself should never allocate memory with\n__GFP_KSWAPD_RECLAIM as waking up kswapd ends up acquiring pi_lock,\nwhich leads to a deadlock.\nReproducing the issue even intentionally was not straightforward.\nThe set_cpus_allowed_force() path that is called under pi_lock is\nexercised very rarely, and competing tasks that allocate memory will\nmost likely wake kswapd up.\nTherefore the existence of the deadlock was verified with a modified\nkernel that has a lockdep map for waking up kswapd:\n======================================================\nWARNING: possible circular locking dependency detected\n7.2.0-rc1-slab-for-next+ #10 Not tainted\n------------------------------------------------------\ngit/6660 is trying to acquire lock:\nffff8e524533c550 (&p->pi_lock){-.-.}-{2:2}, at: _raw_spin_lock_irqsave+0x12/0x20\nbut task is already holding lock:\nffff8e57bffff1a0 (&pgdat->kswapd_wait){....}-{3:3}, at: _raw_spin_lock_irqsave+0x12/0x20\nwhich lock already depends on the new lock.\nthe existing dependency chain (in reverse order) is:\n-> #2 (&pgdat->kswapd_wait){....}-{3:3}:\n__lock_acquire+0x5a4/0xc50\nlock_acquire.part.0+0xb7/0x240\nlock_acquire+0x70/0x170\n__raw_spin_lock_irqsave+0x44/0x80\n_raw_spin_lock_irqsave+0x12/0x20\n__wake_up_common_lock+0x31/0xa0\n__wake_up+0x20/0x40\nkswapd_wakeup_wake+0x7e/0x110\nwakeup_kswapd+0x295/0x320\nwake_all_kswapds+0xac/0x1a0\n__alloc_pages_slowpath.constprop.0+0x282/0xf80\n__alloc_frozen_pages_noprof+0x32a/0x360\nalloc_slab_page+0x2e/0x160\nallocate_slab+0x82/0x420\nnew_slab+0x52/0xb0\nrefill_objects+0x13d/0x190\nrefill_sheaf+0x5d/0xd0\n__pcs_replace_empty_main+0x230/0xb10\n[...]\n-> #1 (kswapd_wakeup){-.-.}-{0:0}:\n__lock_acquire+0x5a4/0xc50\nlock_sync.part.0+0x75/0x100\nlock_sync+0x36/0x70\nmight_wakeup_kswapd+0x61/0xa0\n__kfree_rcu_sheaf+0x33/0xd90\nkvfree_call_rcu+0x1d4/0x3b0\nset_cpus_allowed_force+0x163/0x220\ncpuset_cpus_allowed_fallback+0x18b/0x240\nselect_fallback_rq+0x1e6/0x250\n[...]\n-> #0 (&p->pi_lock){-.-.}-{2:2}:\ncheck_prev_add+0xe6/0xe00\nvalidate_chain+0x51e/0x6e0\n__lock_acquire+0x5a4/0xc50\nlock_acquire.part.0+0xb7/0x240\nlock_acquire+0x70/0x170\n__raw_spin_lock_irqsave+0x44/0x80\n_raw_spin_lock_irqsave+0x12/0x20\ntry_to_wake_up+0x77/0xa90\ndefault_wake_function+0x27/0x60\nautoremove_wake_function+0x23/0xb0\n__wake_up_common+0xb8/0x170\n__wake_up_common_lock+0x51/0xa0\n__wake_up+0x20/0x40\nkswapd_wakeup_wake+0x7e/0x110\nwakeup_kswapd+0x295/0x320\nwake_all_kswapds+0xac/0x1a0\n__alloc_pages_slowpath.constprop.0+0x282/0xf80\n__alloc_frozen_pages_noprof+0x32a/0x360\nalloc_slab_page+0x2e/0x160\nallocate_slab+0x82/0x420\nnew_slab+0x52/0xb0\nrefill_objects+0x13d/0x190\nrefill_sheaf+0x5d/0xd0\n__pcs_replace_empty_main+0x230/0xb10\n[...]\nother info that might help us debug this:\nChain exists of:\n&p->pi_lock --> kswapd_wakeup --> &pgdat->kswapd_wait\nPossible unsafe locking scenario:\nCPU0 CPU1\n---- ----\nlock(&pgdat->kswapd_wait);\nlock(kswapd_wakeup);\nlock(&pgdat->kswapd_wait);\nlock(&p->pi_lock);\n*** DEADLOCK ***\n3 locks held by git/6660:\n#0: ffff8e519f0e9e20 (&type->i_mutex_dir_key#6){++++}-{4:4}, at: lookup_slow+0x2d/0x60\n#1: ffffffff8a31c460 (kswapd_wakeup){-.-.}-\n---truncated---", "A flaw was found in the Linux kernel. When freeing memory through the slab allocator, the system may attempt to wake the kernel swap daemon while an internal scheduler lock is already held. This unsafe sequence can trigger a circular locking dependency and cause a system deadlock. A local user could exploit this condition to trigger a system hang, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98818", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98818\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98818\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98818.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec66e0d599520ab414db745544e25d80d0ac5054,46545c86b54ffb969b6e3662942b4a6191619eaa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec66e0d599520ab414db745544e25d80d0ac5054,af2fb3ee6679b517e2fdbd3ba16ec276a8b74312)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:30:17.102748+00:00", "updated": "2026-10-24T04:30:08.034980+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}