In the Linux kernel, the following vulnerability has been resolved:
mm: fix zswap writeback race condition
The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was written to a different page.
The race unfolds like this: 1. a page with data A and swap offset X is stored in zswap 2. page A is removed off the LRU by zpool driver for writeback in zswap-shrink work, data for A is mapped by zpool driver 3. user space program faults and invalidates page entry A, offset X is considered free 4. kswapd stores page B at offset X in zswap (zswap could also be full, if so, page B would then be IOed to X, then skip step 5.) 5. entry A is replaced by B in tree->rbroot, this doesn't affect the local reference held by zswap-shrink work 6. zswap-shrink work writes back A at X, and frees zswap entry A 7. swapin of slot X brings A in memory instead of B
The fix: Once the swap page cache has been allocated (case ZSWAP_SWAPCACHE_NEW), zswap-shrink work just checks that the local zswap_entry reference is still the same as the one in the tree. If it's not the same it means that it's either been invalidated or replaced, in both cases the writeback is aborted because the local entry contains stale data.
Reproducer: I originally found this by running `stress` overnight to validate my work on the zswap writeback mechanism, it manifested after hours on my test machine. The key to make it happen is having zswap writebacks, so whatever setup pumps /sys/kernel/debug/zswap/written_back_pages should do the trick.
In order to reproduce this faster on a vm, I setup a system with ~100M of available memory and a 500M swap file, then running `stress --vm 1 --vm-bytes 300000000 --vm-stride 4000` makes it happen in matter of tens of minutes. One can speed things up even more by swinging /sys/module/zswap/parameters/max_pool_percent up and down between, say, 20 and 1; this makes it reproduce in tens of seconds. It's crucial to set `--vm-stride` to something other than 4096 otherwise `stress` won't realize that memory has been corrupted because all pages would have the same data.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-toolsUpgrade kernel-debug-coreUpgrade kernel-modules-extraUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-debug-develUpgrade kernel-cross-headersUpgrade bpftoolUpgrade kernel-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade kernelUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-develUpgrade perfUpgrade kernel-develUpgrade kernel-tools-libs-develUpgrade kernel-headersUpgrade kernel-docUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modulesUpgrade python3-perfUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-devel | Nov 12, 2025 | Nov 10, 2025 |
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade python-perfUpgrade kernel-livepatch-5.10.258-257.1041Upgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade perfUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64 | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-libbpf-staticUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade python3-perfUpgrade kernel-develUpgrade kernel-libbpfUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-6.1.34-56.100Upgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade perf | Sep 30, 2025 | Sep 15, 2025 |
| Debian | — | Upgrade linux | Sep 17, 2025 | Sep 17, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libs | Dec 12, 2025 | Dec 11, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libs | Jan 15, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel | Dec 12, 2025 | Dec 11, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 12, 2025 | Sep 15, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Nov 7, 2025 | Sep 15, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64 | Feb 5, 2026 | Nov 13, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub