CVE-2026-23161

{"id": "CVE-2026-23161", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2026-02-14T16:15:56.277", "references": [{"url": "https://git.kernel.org/stable/c/8a1968bd997f45a9b11aefeabdd1232e1b6c7184", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a99f9a4669a04662c8f9efe0e62cafc598153139", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b23bee8cdb7aabce5701a7f57414db5a354ae8ed", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix race of truncate and swap entry split\n\nThe helper for shmem swap freeing is not handling the order of swap\nentries correctly. It uses xa_cmpxchg_irq to erase the swap entry, but it\ngets the entry order before that using xa_get_order without lock\nprotection, and it may get an outdated order value if the entry is split\nor changed in other ways after the xa_get_order and before the\nxa_cmpxchg_irq.\n\nAnd besides, the order could grow and be larger than expected, and cause\ntruncation to erase data beyond the end border. For example, if the\ntarget entry and following entries are swapped in or freed, then a large\nfolio was added in place and swapped out, using the same entry, the\nxa_cmpxchg_irq will still succeed, it's very unlikely to happen though.\n\nTo fix that, open code the Xarray cmpxchg and put the order retrieval and\nvalue checking in the same critical section. Also, ensure the order won't\nexceed the end border, skip it if the entry goes across the border.\n\nSkipping large swap entries crosses the end border is safe here. Shmem\ntruncate iterates the range twice, in the first iteration,\nfind_lock_entries already filtered such entries, and shmem will swapin the\nentries that cross the end border and partially truncate the folio (split\nthe folio or at least zero part of it). So in the second loop here, if we\nsee a swap entry that crosses the end order, it must at least have its\ncontent erased already.\n\nI observed random swapoff hangs and kernel panics when stress testing\nZSWAP with shmem. After applying this patch, all problems are gone."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nmm/shmem, swap: corrige la condici\u00f3n de carrera entre el truncamiento y la divisi\u00f3n de entradas de swap\n\nLa funci\u00f3n auxiliar para la liberaci\u00f3n de swap de shmem no est\u00e1 manejando correctamente el orden de las entradas de swap. Utiliza xa_cmpxchg_irq para borrar la entrada de swap, pero obtiene el orden de la entrada antes de eso usando xa_get_order sin protecci\u00f3n de bloqueo, y puede obtener un valor de orden obsoleto si la entrada se divide o cambia de otras maneras despu\u00e9s de xa_get_order y antes de xa_cmpxchg_irq.\n\nY adem\u00e1s, el orden podr\u00eda crecer y ser mayor de lo esperado, y causar que el truncamiento borre datos m\u00e1s all\u00e1 del l\u00edmite final. Por ejemplo, si la entrada objetivo y las entradas siguientes se intercambian (swap in) o se liberan, y luego se a\u00f1adi\u00f3 un folio grande en su lugar y se intercambi\u00f3 (swap out), usando la misma entrada, el xa_cmpxchg_irq seguir\u00e1 teniendo \u00e9xito, aunque es muy poco probable que ocurra.\n\nPara solucionar eso, se implementa directamente el cmpxchg de Xarray y se coloca la recuperaci\u00f3n del orden y la verificaci\u00f3n del valor en la misma secci\u00f3n cr\u00edtica. Adem\u00e1s, se asegura que el orden no exceda el l\u00edmite final, se omite si la entrada cruza el l\u00edmite.\n\nOmitir entradas de swap grandes que cruzan el l\u00edmite final es seguro aqu\u00ed. El truncamiento de shmem itera el rango dos veces; en la primera iteraci\u00f3n, find_lock_entries ya filtr\u00f3 dichas entradas, y shmem intercambiar\u00e1 (swap in) las entradas que cruzan el l\u00edmite final y truncar\u00e1 parcialmente el folio (dividir\u00e1 el folio o al menos pondr\u00e1 a cero parte de \u00e9l). As\u00ed que, en el segundo bucle aqu\u00ed, si vemos una entrada de swap que cruza el orden final, al menos ya debe tener su contenido borrado.\n\nObserv\u00e9 bloqueos aleatorios de swapoff y 'kernel panics' al realizar pruebas de estr\u00e9s de ZSWAP con shmem. Despu\u00e9s de aplicar este parche, todos los problemas desaparecieron."}], "lastModified": "2026-04-03T14:16:24.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99E9F57D-2677-42E9-A3C5-5657D35646BA", "versionEndExcluding": "6.12.69", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "171CFCB2-8F49-4F9E-8A67-FAC6BF45B5A2", "versionEndExcluding": "6.18.9", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}