Description
In the Linux kernel, the following vulnerability has been resolved:
mm: fix zswap writeback race condition
The zswap writeback mechanism can cause a race condition resulting in
memory corruption, where a swapped out page gets swapped in with data that
was written to a different page.
The race unfolds like this:
1. a page with data A and swap offset X is stored in zswap
2. page A is removed off the LRU by zpool driver for writeback in
zswap-shrink work, data for A is mapped by zpool driver
3. user space program faults and invalidates page entry A, offset X is
considered free
4. kswapd stores page B at offset X in zswap (zswap could also be
full, if so, page B would then be IOed to X, then skip step 5.)
5. entry A is replaced by B in tree->rbroot, this doesn't affect the
local reference held by zswap-shrink work
6. zswap-shrink work writes back A at X, and frees zswap entry A
7. swapin of slot X brings A in memory instead of B
The fix:
Once the swap page cache has been allocated (case ZSWAP_SWAPCACHE_NEW),
zswap-shrink work just checks that the local zswap_entry reference is
still the same as the one in the tree. If it's not the same it means that
it's either been invalidated or replaced, in both cases the writeback is
aborted because the local entry contains stale data.
Reproducer:
I originally found this by running `stress` overnight to validate my work
on the zswap writeback mechanism, it manifested after hours on my test
machine. The key to make it happen is having zswap writebacks, so
whatever setup pumps /sys/kernel/debug/zswap/written_back_pages should do
the trick.
In order to reproduce this faster on a vm, I setup a system with ~100M of
available memory and a 500M swap file, then running `stress --vm 1
--vm-bytes 300000000 --vm-stride 4000` makes it happen in matter of tens
of minutes. One can speed things up even more by swinging
/sys/module/zswap/parameters/max_pool_percent up and down between, say, 20
and 1; this makes it reproduce in tens of seconds. It's crucial to set
`--vm-stride` to something other than 4096 otherwise `stress` won't
realize that memory has been corrupted because all pages would have the
same data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 3.11 | 6.1.30 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.3.7-1 | — |
| Debian 13 | linux | 6.3.7-1 | — |
| Debian 12 | linux | 6.1.37-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu 24.04 LTS | linux-intel +9 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +49 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime +1 | No fix yet | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux +21 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +12 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.4.0-503.11.1.el9_5 | RHSA-2024:9315 |
| RHEL 9 | rv +67 | 5.14.0-503.11.1.el9_5 | RHSA-2024:9315 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.83.1.rt7.424.el8_10 | RHSA-2025:19932 |
| RHEL 8 | perf +26 | 4.18.0-553.83.1.el8_10 | RHSA-2025:19931 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Rt Els 7 | kernel-rt +7 | 3.10.0-1160.144.1.rt56.1296.el7 | RHSA-2025:23960 |
| RHEL 9.4 EUS | bpftool | 7.3.0-427.97.1.el9_4 | RHSA-2025:19886 |
| RHEL 9.4 EUS | rv +64 | 5.14.0-427.97.1.el9_4 | RHSA-2025:19886 |
| RHEL 9.2 E4S | bpftool | 7.0.0-284.146.1.el9_2 | RHSA-2025:21051 |
| RHEL 9.2 E4S | kernel-rt +14 | 5.14.0-284.146.1.rt14.431.el9_2 | RHSA-2025:21128 |
| RHEL 9.2 E4S | perf +47 | 5.14.0-284.146.1.el9_2 | RHSA-2025:21051 |
| RHEL 9.0 E4S | kernel-rt +12 | 5.14.0-70.153.1.rt21.225.el9_0 | RHSA-2025:21136 |
| RHEL 9.0 E4S | perf +28 | 5.14.0-70.153.1.el9_0 | RHSA-2025:21091 |
| RHEL 8.8 TUS | perf +17 | 4.18.0-477.118.1.el8_8 | RHSA-2025:21083 |
| RHEL 8.8 E4S | perf +18 | 4.18.0-477.118.1.el8_8 | RHSA-2025:21083 |
| RHEL 8.6 TUS | perf +17 | 4.18.0-372.168.1.el8_6 | RHSA-2025:21084 |
| RHEL 8.6 E4S | perf +25 | 4.18.0-372.168.1.el8_6 | RHSA-2025:21084 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.168.1.el8_6 | RHSA-2025:21084 |
| RHEL 8.4 EUS Long Life | perf +17 | 4.18.0-305.179.1.el8_4 | RHSA-2025:22752 |
| RHEL 8.4 AUS | perf +17 | 4.18.0-305.179.1.el8_4 | RHSA-2025:22752 |
| RHEL 8.2 AUS | perf +17 | 4.18.0-193.178.1.el8_2 | RHSA-2025:23445 |
| RHEL 7 ELS | perf +18 | 3.10.0-1160.144.1.el7 | RHSA-2025:23947 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.83.1.rt7.424.el8_10 | ALSA-2025:19932 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.83.1.el8_10 | ALSA-2025:19931 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | kernel | 4.18.0-553.83.1.el8_10 | RLSA-2025:19931 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.83.1.rt7.424.el8_10 | RLSA-2025:19932 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.124.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.179.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLES 15 SP3 | kernel-64kb +7 | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLES 15 SP3 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.275.1 | SUSE-SU-2026:0473-1, SUSE-SU-2025:03614-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLES for SAP 15 SP5 | kernel-docs +4 | 5.14.21-150500.55.124.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.179.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLES for SAP 15 SP3 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
| SLES for SAP 15 SP3 | kernel-docs +5 | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.109.1 | SUSE-SU-2026:0496-1, SUSE-SU-2025:3761-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.124.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLE Micro 5.4 | kernel-default | 5.14.21-150400.24.179.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.133.1 | SUSE-SU-2026:1131-1, SUSE-SU-2025:3716-1 |
| SLE Micro 5.3 | kernel-default | 5.14.21-150400.24.179.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.133.1 | SUSE-SU-2026:1131-1, SUSE-SU-2025:3716-1 |
| SLE Micro 5.2 | kernel-default | 5.3.18-150300.59.221.1 | SUSE-SU-2026:0475-1, SUSE-SU-2025:03626-1 |
| SLE Micro 5.2 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2026:0475-1, SUSE-SU-2025:03626-1 |
| SLE Micro 5.2 | kernel-rt +1 | 5.3.18-150300.223.1 | SUSE-SU-2026:0495-1, SUSE-SU-2025:03613-1 |
| SLE Micro 5.1 | kernel-default | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLE Micro 5.1 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
| SLE Micro 5.1 | kernel-rt +1 | 5.3.18-150300.223.1 | SUSE-SU-2025:03613-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.124.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_31 +1 | 1-150500.11.3.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.179.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_45 | 1-150400.9.3.1 | SUSE-SU-2025:03628-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_48 | 1-150400.9.7.1 | SUSE-SU-2026:0617-1 |
| SLE Live Patching 15 SP3 | kernel-default | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_62 | 1-150300.7.3.1 | SUSE-SU-2025:03626-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.275.1 | SUSE-SU-2026:0473-1, SUSE-SU-2025:03614-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_73 +1 | 1-8.3.1 | SUSE-SU-2026:0473-1, SUSE-SU-2025:03614-1 |
| SLE HPC 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.124.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2026:0474-1, SUSE-SU-2025:03615-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.179.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2026:0617-1, SUSE-SU-2025:03628-1 |
| SLE HPC 15 SP3 | kernel-64kb +6 | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLE HPC 15 SP3 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
| SUSE Manager Server LTS 4.3 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Server LTS 4.3 | kernel-syms +3 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Proxy LTS 4.3 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Proxy LTS 4.3 | kernel-syms +2 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SUSE Enterprise Storage 7.1 | kernel-64kb +6 | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SUSE Enterprise Storage 7.1 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.1.34-56.100 | 1.0-0.amzn2023 | ALAS2023-2023-228 |
| Amazon Linux 2023 | perf +12 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | kernel | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | perf +19 | 4.18.0-553.83.1.el8_10 | ELSA-2025-19931 |
| Oracle Linux 7 | perf +12 | 3.10.0-1160.119.1.0.16.el7 | ELSA-2025-23947 |
Advisories 37
- WID-SEC-2025-2053 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- ALSA-2025:19931 Moderate: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:19932 Moderate: kernel-rt security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:9315 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:22752 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:23445 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2026-0349 Dell Avamar und NetWorker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- RHSA-2025:23960 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:23947 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:21136 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:21091 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:21128 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:21083 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:21051 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:21084 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2025:19932 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2025:19931 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2025:19886 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- SUSE-SU-2026:1131-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 31, 2026
- SUSE-SU-2026:0495-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0496-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0474-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0475-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0473-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0617-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 26, 2026
- ALAS2023-2023-228 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 11, 2026
- SUSE-SU-2025:03613-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03615-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03626-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3761-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03628-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03614-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3716-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2025-23947 Moderate: kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 30, 2026
- RLSA-2025:19931 Moderate: kernel security update Rocky Linux Security Advisories · Nov 13, 2025
- RLSA-2025:19932 Moderate: kernel-rt security update Rocky Linux Security Advisories · Nov 13, 2025
- ELSA-2025-19931 Moderate: kernel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2025