Linux kernel mm/swap: hibernation slot freed while cached corrupts unrelated processes' memory

Impact

swap_free_hibernation_slot() frees a swap slot without checking whether a folio for it sits in the swap cache, so cluster readahead can leave a folio orphaned from the swap table while the offset is handed back to the allocator. Later reclaim writes that folio's stale offset over a swap table entry that now belongs to another process. The result is silent memory corruption, process crashes or data instability across unrelated userspace - exactly the failure mode that looks like flaky hardware and burns days of debugging on a long training run. Exposure is narrow: it triggers when uswsusp prepares a hibernation image, and datacenter GPU hosts normally never hibernate, so most fleets can take this on the regular kernel cadence.

Who can reach it

Local, and only on a host where hibernation (uswsusp) actually runs with swap configured. Not reachable from a tenant pod on a server that has hibernation disabled.

What to do

Pick up the stable fix that checks for a cached folio before freeing the hibernation slot (two commits linked). Requires a kernel update and a reboot per node. If your hosts never hibernate, the code path is not reached and you can wait for the next scheduled kernel roll. The record names no fixed release versions.

References

Related entries

• Linux kernel trusted keys: use-after-free when the trusted-key TPM backend is torn downCVE-2026-89763 · Linux kernel KEYS trusted-key TPM backend (module teardown ordering)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh
• QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processCVE-2021-3748 · QEMU (virtio-net)High