{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-02T00:52:21.933","vulnerabilities":[{"cve":{"id":"CVE-2026-23161","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-02-14T16:15:56.277","lastModified":"2026-04-03T14:16:24.830","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix race of truncate and swap entry split\n\nThe helper for shmem swap freeing is not handling the order of swap\nentries correctly.  It uses xa_cmpxchg_irq to erase the swap entry, but it\ngets the entry order before that using xa_get_order without lock\nprotection, and it may get an outdated order value if the entry is split\nor changed in other ways after the xa_get_order and before the\nxa_cmpxchg_irq.\n\nAnd besides, the order could grow and be larger than expected, and cause\ntruncation to erase data beyond the end border.  For example, if the\ntarget entry and following entries are swapped in or freed, then a large\nfolio was added in place and swapped out, using the same entry, the\nxa_cmpxchg_irq will still succeed, it's very unlikely to happen though.\n\nTo fix that, open code the Xarray cmpxchg and put the order retrieval and\nvalue checking in the same critical section.  Also, ensure the order won't\nexceed the end border, skip it if the entry goes across the border.\n\nSkipping large swap entries crosses the end border is safe here.  Shmem\ntruncate iterates the range twice, in the first iteration,\nfind_lock_entries already filtered such entries, and shmem will swapin the\nentries that cross the end border and partially truncate the folio (split\nthe folio or at least zero part of it).  So in the second loop here, if we\nsee a swap entry that crosses the end order, it must at least have its\ncontent erased already.\n\nI observed random swapoff hangs and kernel panics when stress testing\nZSWAP with shmem.  After applying this patch, all problems are gone."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nmm/shmem, swap: corrige la condición de carrera entre el truncamiento y la división de entradas de swap\n\nLa función auxiliar para la liberación de swap de shmem no está manejando correctamente el orden de las entradas de swap. Utiliza xa_cmpxchg_irq para borrar la entrada de swap, pero obtiene el orden de la entrada antes de eso usando xa_get_order sin protección de bloqueo, y puede obtener un valor de orden obsoleto si la entrada se divide o cambia de otras maneras después de xa_get_order y antes de xa_cmpxchg_irq.\n\nY además, el orden podría crecer y ser mayor de lo esperado, y causar que el truncamiento borre datos más allá del límite final. Por ejemplo, si la entrada objetivo y las entradas siguientes se intercambian (swap in) o se liberan, y luego se añadió un folio grande en su lugar y se intercambió (swap out), usando la misma entrada, el xa_cmpxchg_irq seguirá teniendo éxito, aunque es muy poco probable que ocurra.\n\nPara solucionar eso, se implementa directamente el cmpxchg de Xarray y se coloca la recuperación del orden y la verificación del valor en la misma sección crítica. Además, se asegura que el orden no exceda el límite final, se omite si la entrada cruza el límite.\n\nOmitir entradas de swap grandes que cruzan el límite final es seguro aquí. El truncamiento de shmem itera el rango dos veces; en la primera iteración, find_lock_entries ya filtró dichas entradas, y shmem intercambiará (swap in) las entradas que cruzan el límite final y truncará parcialmente el folio (dividirá el folio o al menos pondrá a cero parte de él). Así que, en el segundo bucle aquí, si vemos una entrada de swap que cruza el orden final, al menos ya debe tener su contenido borrado.\n\nObservé bloqueos aleatorios de swapoff y 'kernel panics' al realizar pruebas de estrés de ZSWAP con shmem. Después de aplicar este parche, todos los problemas desaparecieron."}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.69","matchCriteriaId":"99E9F57D-2677-42E9-A3C5-5657D35646BA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.9","matchCriteriaId":"171CFCB2-8F49-4F9E-8A67-FAC6BF45B5A2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*","matchCriteriaId":"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*","matchCriteriaId":"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*","matchCriteriaId":"F71D92C0-C023-48BD-B3B6-70B638EEE298"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*","matchCriteriaId":"13580667-0A98-40CC-B29F-D12790B91BDB"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*","matchCriteriaId":"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*","matchCriteriaId":"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*","matchCriteriaId":"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8a1968bd997f45a9b11aefeabdd1232e1b6c7184","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/a99f9a4669a04662c8f9efe0e62cafc598153139","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b23bee8cdb7aabce5701a7f57414db5a354ae8ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}}]}