CVE-2024-26759
published 2024-04-03CVE-2024-26759: In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWP_SYNCHRONOUS_IO…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix race when skipping swapcache
When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads
swapin the same entry at the same time, they get different pages (A, B).
Before one thread (T0) finishes the swapin and installs page (A) to the
PTE, another thread (T1) could finish swapin of page (B), swap_free the
entry, then swap out the possibly modified page reusing the same entry.
It breaks the pte_same check in (T0) because PTE value is unchanged,
causing ABA problem. Thread (T0) will install a stalled page (A) into the
PTE and cause data corruption.
One possible callstack is like this:
CPU0 CPU1
---- ----
do_swap_page() do_swap_page() with same entry
swap_read_folio()
... set_pte_at()
swap_free()
pte_same() <- Check pass, PTE seems
unchanged, but page A
is stalled!
swap_free() <- page B content lost!
set_pte_at() <- staled page A installed!
And besides, for ZRAM, swap_free() allows the swap device to discard the
entry content, so even if page (B) is not modified, if swap_read_folio()
on CPU0 happens later than swap_free() on CPU1, it may also cause data
loss.
To fix this, reuse swapcache_prepare which will pin the swap entry using
the cache flag, and allow only one thread to swap it in, also prevent any
parallel code from putting the entry in the cache. Release the pin after
PT unlocked.
Racers just loop and wait since it's a rare and very short event. A
schedule_timeout_uninterruptible(1) call is added to avoid repeated page
faults wasting too much CPU, causing livelock or adding too much noise to
perf statistics. A similar livelock issue was described in commit
029c4628b2eb ("mm: swap: get rid of livelock in swapin readahead")
Reproducer:
This race issue can be triggered easily using a well constructed
reproducer and patched brd (with a delay in read path) [1]:
With latest 6.8 mainline, race caused data loss can be observed easily:
$ gcc -g -lpthread test-thread-sw
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.82-1 (bookworm) | linux 6.1.82-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 0bcac06f27d7528591c27ac2b093ccd71c5d0168 < 2dedda77d4493f3e92e414b272bfa60f1f51ed95 | 2dedda77d4493f3e92e414b272bfa60f1f51ed95 |
| linux | linux | >= 0bcac06f27d7528591c27ac2b093ccd71c5d0168 < 305152314df82b22cf9b181f3dc5fc411002079a | 305152314df82b22cf9b181f3dc5fc411002079a |
| linux | linux | >= 0bcac06f27d7528591c27ac2b093ccd71c5d0168 < d183a4631acfc7af955c02a02e739cec15f5234d | d183a4631acfc7af955c02a02e739cec15f5234d |
| linux | linux | >= 0bcac06f27d7528591c27ac2b093ccd71c5d0168 < 13ddaf26be324a7f951891ecd9ccd04466d27458 | 13ddaf26be324a7f951891ecd9ccd04466d27458 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.82-1 | 6.1.82-1 |
| linux | linux_kernel | >= 0 < 6.7.7-1 | 6.7.7-1 |
| linux | linux_kernel | >= 0 < 6.7.7-1 | 6.7.7-1 |
| linux | linux_kernel | >= 4.15 < 6.1.80 | 6.1.80 |
| linux | linux_kernel | >= 6.2 < 6.6.19 | 6.6.19 |
| linux | linux_kernel | >= 6.7 < 6.7.7 | 6.7.7 |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
mm/swap: fix race when skipping swapcache
vendor_msrc·2024-04-09·CVSS 5.5
CVE-2024-26759 [MEDIUM] CWE-787 mm/swap: fix race when skipping swapcache
mm/swap: fix race when skipping swapcache
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Red Hat
kernel: mm/swap: fix race when skipping swapcache
vendor_redhat·2024-04-03·CVSS 5.5
CVE-2024-26759 [MEDIUM] CWE-362 kernel: mm/swap: fix race when skipping swapcache
kernel: mm/swap: fix race when skipping swapcache
In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix race when skipping swapcache
When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads
swapin the same entry at the same time, they get different pages (A, B).
Before one thread (T0) finishes the swapin and installs page (A) to the
PTE, another thread (T1) could finish swapin of page (B), swap_free the
entry, then swap out the possibly modified page reusing the same entry.
It breaks the pte_same check in (T0) because PTE value is unchanged,
causing ABA problem. Thread (T0) will install a stalled page (A) into the
PTE and cause data corruption.
One possible callstack is like this:
CPU0 CPU1
---- ----
do_swap_page() do_swap_page() with same entry
Debian
CVE-2024-26759: linux - In the Linux kernel, the following vulnerability has been resolved: mm/swap: fi...
vendor_debian·2024·CVSS 5.5
CVE-2024-26759 [MEDIUM] CVE-2024-26759: linux - In the Linux kernel, the following vulnerability has been resolved: mm/swap: fi...
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads swapin the same entry at the same time, they get different pages (A, B). Before one thread (T0) finishes the swapin and installs page (A) to the PTE, another thread (T1) could finish swapin of page (B), swap_free the entry, then swap out the possibly modified page reusing the same entry. It breaks the pte_same check in (T0) because PTE value is unchanged, causing ABA problem. Thread (T0) will install a stalled page (A) into the PTE and cause data corruption. One possible callstack is like this: CPU0 CPU1 ---- ---- do_swap_page() do_swap_page() with same entry swap_read_folio() ... set_pte_at() swap_free() pte_sa
OSV
CVE-2024-26759: In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWP_SYNCHRON
osv·2024-04-03·CVSS 5.5
CVE-2024-26759 [MEDIUM] CVE-2024-26759: In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWP_SYNCHRON
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads swapin the same entry at the same time, they get different pages (A, B). Before one thread (T0) finishes the swapin and installs page (A) to the PTE, another thread (T1) could finish swapin of page (B), swap_free the entry, then swap out the possibly modified page reusing the same entry. It breaks the pte_same check in (T0) because PTE value is unchanged, causing ABA problem. Thread (T0) will install a stalled page (A) into the PTE and cause data corruption. One possible callstack is like this: CPU0 CPU1 ---- ---- do_swap_page() do_swap_page() with same entry swap_read_folio() ... set_pte_at() swap_free() pte_sa
GHSA
GHSA-p22p-8399-qrmf: In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix race when skipping swapcache
When skipping swapcache for SWP_SYNCHR
ghsa_unreviewed·2024-04-03
CVE-2024-26759 [MEDIUM] CWE-787 GHSA-p22p-8399-qrmf: In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix race when skipping swapcache
When skipping swapcache for SWP_SYNCHR
In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix race when skipping swapcache
When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads
swapin the same entry at the same time, they get different pages (A, B).
Before one thread (T0) finishes the swapin and installs page (A) to the
PTE, another thread (T1) could finish swapin of page (B), swap_free the
entry, then swap out the possibly modified page reusing the same entry.
It breaks the pte_same check in (T0) because PTE value is unchanged,
causing ABA problem. Thread (T0) will install a stalled page (A) into the
PTE and cause data corruption.
One possible callstack is like this:
CPU0 CPU1
---- ----
do_swap_page() do_swap_page() with same entry
swap_read_folio()
... set_pte_at()
swap_free()
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079ahttps://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234dhttps://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079ahttps://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d
2024-04-03
Published