Linux kernel mm/swap: hibernation slot freed while cached corrupts unrelated processes' memory

Impact

swap_free_hibernation_slot() frees a swap slot without checking whether a folio for it sits in the swap cache, so cluster readahead can leave a folio orphaned from the swap table while the offset is handed back to the allocator. Later reclaim writes that folio's stale offset over a swap table entry that now belongs to another process. The result is silent memory corruption, process crashes or data instability across unrelated userspace - exactly the failure mode that looks like flaky hardware and burns days of debugging on a long training run. Exposure is narrow: it triggers when uswsusp prepares a hibernation image, and datacenter GPU hosts normally never hibernate, so most fleets can take this on the regular kernel cadence.

Who can reach it

Local, and only on a host where hibernation (uswsusp) actually runs with swap configured. Not reachable from a tenant pod on a server that has hibernation disabled.

What to do

Pick up the stable fix that checks for a cached folio before freeing the hibernation slot (two commits linked). Requires a kernel update and a reboot per node. If your hosts never hibernate, the code path is not reached and you can wait for the next scheduled kernel roll. The record names no fixed release versions.

References

Related entries

• Linux kernel trusted keys: use-after-free when the trusted-key TPM backend is torn downCVE-2026-89763 · Linux kernel KEYS trusted-key TPM backend (module teardown ordering)High
• Linux kernel perf: use-after-free when an mmap revival races the last munmap, giving local rootCVE-2026-89791 · Linux kernel perf subsystem (perf_mmap_close / ring-buffer revival race)High
• Linux kernel BPF: bpf_get_stackid runs get_perf_callchain preemptible, exposing its trace bufferCVE-2026-89799 · Linux kernel BPF (bpf_get_stackid, get_perf_callchain preemption)High
• Linux kernel qla2xxx: use-after-free reading 84xx_fw_version during Fibre Channel HBA teardownCVE-2026-89854 · Linux kernel scsi qla2xxx (cs84xx chip release vs. 84xx_fw_version sysfs read)High
• Linux kernel mm/migrate_device: compound folio at the end of a range writes past the PFN arrayCVE-2026-89967 · Linux kernel mm/migrate_device (device-private page migration)High
• Linux kernel mm/mempolicy: weighted-interleave bulk allocation sleeps in atomic contextCVE-2026-89986 · Linux kernel mm/mempolicy (alloc_pages_bulk_weighted_interleave GFP flags)High