CVE-2026-23161

What it actually does

Race condition in shmem swap entry handling allows xa_get_order to retrieve an outdated order value before xa_cmpxchg_irq, enabling truncation to erase data beyond the intended range or cause swapoff hangs and kernel panics.

Why it matters to the business

Linux systems using shared memory and swap may experience unexpected crashes, hangs during swap operations, or data corruption under concurrent truncate and swap activity, leading to downtime and potential loss of work in memory-intensive workloads.

How an attack unfolds

A local attacker with the ability to trigger shmem truncate and concurrent swap entry split operations can win the unprotected order read versus cmpxchg window, causing the kernel to process an incorrect or oversized swap entry and trigger a panic or hang; the issue was observed during ZSWAP stress testing.

How to fix it

Update the Linux kernel to the commit a99f9a4669a04662c8f9efe0e62cafc598153139 or later stable release that contains the fix; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit a99f9a4669a04662c8f9efe0e62cafc598153139 via git log or kernel version string; re-run the original ZSWAP stress test workload that previously triggered hangs and panics to verify absence of symptoms.

Typical attack path

1. Obtain local access on a Linux system using shmem-backed swap.
2. Create conditions that cause concurrent truncate and swap entry split operations.
3. Trigger xa_get_order without lock protection followed by xa_cmpxchg_irq.
4. Force the order value to become stale or exceed the truncation border.
5. Induce kernel panic or swapoff hang.

How to detect it

Search kernel logs and dmesg for swapoff hangs, page fault panics, or warnings related to shmem truncate and swap entry split; look for processes that were performing concurrent truncate and swap activity at the time of the failure.

What your security team should do

• Prioritize kernel updates on systems with heavy shmem and swap usage within the next maintenance window.
• Monitor for swapoff or truncate-related kernel panics in system logs.
• Apply the fix to all distributions derived from the affected stable trees once packages are available.