CVE-2026-23177
published 2026-02-14CVE-2026-23177: In the Linux kernel, the following vulnerability has been resolved: mm, shmem: prevent infinite loop on truncate race When truncating a large swap entry…
PriorityP421medium5.5
EPSS
0.17%
6.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
mm, shmem: prevent infinite loop on truncate race
When truncating a large swap entry, shmem_free_swap() returns 0 when the
entry's index doesn't match the given index due to lookup alignment. The
failure fallback path checks if the entry crosses the end border and
aborts when it happens, so truncate won't erase an unexpected entry or
range. But one scenario was ignored.
When `index` points to the middle of a large swap entry, and the large
swap entry doesn't go across the end border, find_get_entries() will
return that large swap entry as the first item in the batch with
`indices[0]` equal to `index`. The entry's base index will be smaller
than `indices[0]`, so shmem_free_swap() will fail and return 0 due to the
"base < index" check. The code will then call shmem_confirm_swap(), get
the order, check if it crosses the END boundary (which it doesn't), and
retry with the same index.
The next iteration will find the same entry again at the same index with
same indices, leading to an infinite loop.
Fix this by retrying with a round-down index, and abort if the index is
smaller than the truncate range.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.18.10-1 (forky) | linux 6.18.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 809bc86517cc408b5b8cb8e08e69096639432bc8 < dfc3ab6bd64860f8022d69903be299d09be86e11 | dfc3ab6bd64860f8022d69903be299d09be86e11 |
| linux | linux | >= 809bc86517cc408b5b8cb8e08e69096639432bc8 < 7b6a0f121d50234aab3e7ab9a62ebe826d40a32a | 7b6a0f121d50234aab3e7ab9a62ebe826d40a32a |
| linux | linux | >= 809bc86517cc408b5b8cb8e08e69096639432bc8 < 2030dddf95451b4e7a389f052091e7c4b7b274c6 | 2030dddf95451b4e7a389f052091e7c4b7b274c6 |
| linux | linux_kernel | >= 0 < 6.12.73-1 | 6.12.73-1 |
| linux | linux_kernel | >= 0 < 6.18.10-1 | 6.18.10-1 |
| linux | linux_kernel | >= 6.12.0 < 6.12.70 | 6.12.70 |
| linux | linux_kernel | >= 6.13.0 < 6.18.10 | 6.18.10 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: mm, shmem: prevent infinite loop on truncate race
vendor_redhat·2026-02-14·CVSS 5.5
CVE-2026-23177 [MEDIUM] CWE-835 kernel: mm, shmem: prevent infinite loop on truncate race
kernel: mm, shmem: prevent infinite loop on truncate race
In the Linux kernel, the following vulnerability has been resolved:
mm, shmem: prevent infinite loop on truncate race
When truncating a large swap entry, shmem_free_swap() returns 0 when the
entry's index doesn't match the given index due to lookup alignment. The
failure fallback path checks if the entry crosses the end border and
aborts when it happens, so truncate won't erase an unexpected entry or
range. But one scenario was ignored.
When `index` points to the middle of a large swap entry, and the large
swap entry doesn't go across the end border, find_get_entries() will
return that large swap entry as the first item in the batch with
`indices[0]` equal to `index`. The entry's base index will be smaller
than `indices[0]`, so shm
Debian
CVE-2026-23177: linux - In the Linux kernel, the following vulnerability has been resolved: mm, shmem: ...
vendor_debian·2026
CVE-2026-23177 [LOW] CVE-2026-23177: linux - In the Linux kernel, the following vulnerability has been resolved: mm, shmem: ...
In the Linux kernel, the following vulnerability has been resolved: mm, shmem: prevent infinite loop on truncate race When truncating a large swap entry, shmem_free_swap() returns 0 when the entry's index doesn't match the given index due to lookup alignment. The failure fallback path checks if the entry crosses the end border and aborts when it happens, so truncate won't erase an unexpected entry or range. But one scenario was ignored. When `index` points to the middle of a large swap entry, and the large swap entry doesn't go across the end border, find_get_entries() will return that large swap entry as the first item in the batch with `indices[0]` equal to `index`. The entry's base index will be smaller than `indices[0]`, so shmem_free_swap() will fail and return 0 due to the "base < in
VulDB
Linux Kernel up to 6.12.69/6.18.9 mm shmem_free_swap infinite loop (EUVD-2026-5864 / Nessus ID 299097)
vuldb·2026-08-09
CVE-2026-23177 [CRITICAL] Linux Kernel up to 6.12.69/6.18.9 mm shmem_free_swap infinite loop (EUVD-2026-5864 / Nessus ID 299097)
A vulnerability has been found in Linux Kernel up to 6.12.69/6.18.9 and classified as critical. This impacts the function shmem_free_swap of the component mm. This manipulation causes infinite loop.
The identification of this vulnerability is CVE-2026-23177. The attack needs to be done within the local network. There is no exploit available.
The affected component should be upgraded.
OSV
mm, shmem: prevent infinite loop on truncate race
osv·2026-02-14
CVE-2026-23177 mm, shmem: prevent infinite loop on truncate race
mm, shmem: prevent infinite loop on truncate race
In the Linux kernel, the following vulnerability has been resolved:
mm, shmem: prevent infinite loop on truncate race
When truncating a large swap entry, shmem_free_swap() returns 0 when the
entry's index doesn't match the given index due to lookup alignment. The
failure fallback path checks if the entry crosses the end border and
aborts when it happens, so truncate won't erase an unexpected entry or
range. But one scenario was ignored.
When `index` points to the middle of a large swap entry, and the large
swap entry doesn't go across the end border, find_get_entries() will
return that large swap entry as the first item in the batch with
`indices[0]` equal to `index`. The entry's base index will be smaller
than `indices[0]`, so shmem_fr
GHSA
GHSA-xwq7-47qj-qwwf: In the Linux kernel, the following vulnerability has been resolved:
mm, shmem: prevent infinite loop on truncate race
When truncating a large swap e
ghsa_unreviewed·2026-02-14
CVE-2026-23177 GHSA-xwq7-47qj-qwwf: In the Linux kernel, the following vulnerability has been resolved:
mm, shmem: prevent infinite loop on truncate race
When truncating a large swap e
In the Linux kernel, the following vulnerability has been resolved:
mm, shmem: prevent infinite loop on truncate race
When truncating a large swap entry, shmem_free_swap() returns 0 when the
entry's index doesn't match the given index due to lookup alignment. The
failure fallback path checks if the entry crosses the end border and
aborts when it happens, so truncate won't erase an unexpected entry or
range. But one scenario was ignored.
When `index` points to the middle of a large swap entry, and the large
swap entry doesn't go across the end border, find_get_entries() will
return that large swap entry as the first item in the batch with
`indices[0]` equal to `index`. The entry's base index will be smaller
than `indices[0]`, so shmem_free_swap() will fail and return 0 due to the
"base <
OSV
CVE-2026-23177: In the Linux kernel, the following vulnerability has been resolved: mm, shmem: prevent infinite loop on truncate race When truncating a large swap ent
osv·2026-02-14
CVE-2026-23177 CVE-2026-23177: In the Linux kernel, the following vulnerability has been resolved: mm, shmem: prevent infinite loop on truncate race When truncating a large swap ent
In the Linux kernel, the following vulnerability has been resolved: mm, shmem: prevent infinite loop on truncate race When truncating a large swap entry, shmem_free_swap() returns 0 when the entry's index doesn't match the given index due to lookup alignment. The failure fallback path checks if the entry crosses the end border and aborts when it happens, so truncate won't erase an unexpected entry or range. But one scenario was ignored. When `index` points to the middle of a large swap entry, and the large swap entry doesn't go across the end border, find_get_entries() will return that large swap entry as the first item in the batch with `indices[0]` equal to `index`. The entry's base index will be smaller than `indices[0]`, so shmem_free_swap() will fail and return 0 due to the "base < in
No detection rules found.
No public exploits indexed.
2026-02-14
Published