CVE-2024-26759 (GCVE-0-2024-26759)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-05-11 20:03
VLAI
Title
mm/swap: fix race when skipping swapcache
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads swapin the same entry at the same time, they get different pages (A, B). Before one thread (T0) finishes the swapin and installs page (A) to the PTE, another thread (T1) could finish swapin of page (B), swap_free the entry, then swap out the possibly modified page reusing the same entry. It breaks the pte_same check in (T0) because PTE value is unchanged, causing ABA problem. Thread (T0) will install a stalled page (A) into the PTE and cause data corruption. One possible callstack is like this: CPU0 CPU1 ---- ---- do_swap_page() do_swap_page() with same entry <direct swapin path> <direct swapin path> <alloc page A> <alloc page B> swap_read_folio() <- read to page A swap_read_folio() <- read to page B <slow on later locks or interrupt> <finished swapin first> ... set_pte_at() swap_free() <- entry is free <write to page B, now page A stalled> <swap out page B to same swap entry> pte_same() <- Check pass, PTE seems unchanged, but page A is stalled! swap_free() <- page B content lost! set_pte_at() <- staled page A installed! And besides, for ZRAM, swap_free() allows the swap device to discard the entry content, so even if page (B) is not modified, if swap_read_folio() on CPU0 happens later than swap_free() on CPU1, it may also cause data loss. To fix this, reuse swapcache_prepare which will pin the swap entry using the cache flag, and allow only one thread to swap it in, also prevent any parallel code from putting the entry in the cache. Release the pin after PT unlocked. Racers just loop and wait since it's a rare and very short event. A schedule_timeout_uninterruptible(1) call is added to avoid repeated page faults wasting too much CPU, causing livelock or adding too much noise to perf statistics. A similar livelock issue was described in commit 029c4628b2eb ("mm: swap: get rid of livelock in swapin readahead") Reproducer: This race issue can be triggered easily using a well constructed reproducer and patched brd (with a delay in read path) [1]: With latest 6.8 mainline, race caused data loss can be observed easily: $ gcc -g -lpthread test-thread-swap-race.c && ./a.out Polulating 32MB of memory region... Keep swapping out... Starting round 0... Spawning 65536 workers... 32746 workers spawned, wait for done... Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss! Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss! Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss! Round 0 Failed, 15 data loss! This reproducer spawns multiple threads sharing the same memory region using a small swap device. Every two threads updates mapped pages one by one in opposite direction trying to create a race, with one dedicated thread keep swapping out the data out using madvise. The reproducer created a reproduce rate of about once every 5 minutes, so the race should be totally possible in production. After this patch, I ran the reproducer for over a few hundred rounds and no data loss observed. Performance overhead is minimal, microbenchmark swapin 10G from 32G zram: Before: 10934698 us After: 11157121 us Cached: 13155355 us (Dropping SWP_SYNCHRONOUS_IO flag) [kasong@tencent.com: v4]
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0bcac06f27d7528591c27ac2b093ccd71c5d0168 , < 2dedda77d4493f3e92e414b272bfa60f1f51ed95 (git)
Affected: 0bcac06f27d7528591c27ac2b093ccd71c5d0168 , < 305152314df82b22cf9b181f3dc5fc411002079a (git)
Affected: 0bcac06f27d7528591c27ac2b093ccd71c5d0168 , < d183a4631acfc7af955c02a02e739cec15f5234d (git)
Affected: 0bcac06f27d7528591c27ac2b093ccd71c5d0168 , < 13ddaf26be324a7f951891ecd9ccd04466d27458 (git)
Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 6.1.80 , ≤ 6.1.* (semver)
Unaffected: 6.6.19 , ≤ 6.6.* (semver)
Unaffected: 6.7.7 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-08T14:03:53.009974Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:35.865Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.279Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/swap.h",
            "mm/memory.c",
            "mm/swap.h",
            "mm/swapfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2dedda77d4493f3e92e414b272bfa60f1f51ed95",
              "status": "affected",
              "version": "0bcac06f27d7528591c27ac2b093ccd71c5d0168",
              "versionType": "git"
            },
            {
              "lessThan": "305152314df82b22cf9b181f3dc5fc411002079a",
              "status": "affected",
              "version": "0bcac06f27d7528591c27ac2b093ccd71c5d0168",
              "versionType": "git"
            },
            {
              "lessThan": "d183a4631acfc7af955c02a02e739cec15f5234d",
              "status": "affected",
              "version": "0bcac06f27d7528591c27ac2b093ccd71c5d0168",
              "versionType": "git"
            },
            {
              "lessThan": "13ddaf26be324a7f951891ecd9ccd04466d27458",
              "status": "affected",
              "version": "0bcac06f27d7528591c27ac2b093ccd71c5d0168",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/swap.h",
            "mm/memory.c",
            "mm/swap.h",
            "mm/swapfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.80",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swap: fix race when skipping swapcache\n\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\nswapin the same entry at the same time, they get different pages (A, B). \nBefore one thread (T0) finishes the swapin and installs page (A) to the\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\nentry, then swap out the possibly modified page reusing the same entry. \nIt breaks the pte_same check in (T0) because PTE value is unchanged,\ncausing ABA problem.  Thread (T0) will install a stalled page (A) into the\nPTE and cause data corruption.\n\nOne possible callstack is like this:\n\nCPU0                                 CPU1\n----                                 ----\ndo_swap_page()                       do_swap_page() with same entry\n\u003cdirect swapin path\u003e                 \u003cdirect swapin path\u003e\n\u003calloc page A\u003e                       \u003calloc page B\u003e\nswap_read_folio() \u003c- read to page A  swap_read_folio() \u003c- read to page B\n\u003cslow on later locks or interrupt\u003e   \u003cfinished swapin first\u003e\n...                                  set_pte_at()\n                                     swap_free() \u003c- entry is free\n                                     \u003cwrite to page B, now page A stalled\u003e\n                                     \u003cswap out page B to same swap entry\u003e\npte_same() \u003c- Check pass, PTE seems\n              unchanged, but page A\n              is stalled!\nswap_free() \u003c- page B content lost!\nset_pte_at() \u003c- staled page A installed!\n\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\nentry content, so even if page (B) is not modified, if swap_read_folio()\non CPU0 happens later than swap_free() on CPU1, it may also cause data\nloss.\n\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\nthe cache flag, and allow only one thread to swap it in, also prevent any\nparallel code from putting the entry in the cache.  Release the pin after\nPT unlocked.\n\nRacers just loop and wait since it\u0027s a rare and very short event.  A\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\nfaults wasting too much CPU, causing livelock or adding too much noise to\nperf statistics.  A similar livelock issue was described in commit\n029c4628b2eb (\"mm: swap: get rid of livelock in swapin readahead\")\n\nReproducer:\n\nThis race issue can be triggered easily using a well constructed\nreproducer and patched brd (with a delay in read path) [1]:\n\nWith latest 6.8 mainline, race caused data loss can be observed easily:\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\n  Polulating 32MB of memory region...\n  Keep swapping out...\n  Starting round 0...\n  Spawning 65536 workers...\n  32746 workers spawned, wait for done...\n  Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\n  Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\n  Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\n  Round 0 Failed, 15 data loss!\n\nThis reproducer spawns multiple threads sharing the same memory region\nusing a small swap device.  Every two threads updates mapped pages one by\none in opposite direction trying to create a race, with one dedicated\nthread keep swapping out the data out using madvise.\n\nThe reproducer created a reproduce rate of about once every 5 minutes, so\nthe race should be totally possible in production.\n\nAfter this patch, I ran the reproducer for over a few hundred rounds and\nno data loss observed.\n\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\nzram:\n\nBefore:     10934698 us\nAfter:      11157121 us\nCached:     13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\n\n[kasong@tencent.com: v4]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:03:37.459Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95"
        },
        {
          "url": "https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d"
        },
        {
          "url": "https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458"
        }
      ],
      "title": "mm/swap: fix race when skipping swapcache",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26759",
    "datePublished": "2024-04-03T17:00:43.288Z",
    "dateReserved": "2024-02-19T14:20:24.170Z",
    "dateUpdated": "2026-05-11T20:03:37.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26759",
      "date": "2026-06-12",
      "epss": "8e-05",
      "percentile": "0.00824"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/swap: fix race when skipping swapcache\\n\\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\\nswapin the same entry at the same time, they get different pages (A, B). \\nBefore one thread (T0) finishes the swapin and installs page (A) to the\\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\\nentry, then swap out the possibly modified page reusing the same entry. \\nIt breaks the pte_same check in (T0) because PTE value is unchanged,\\ncausing ABA problem.  Thread (T0) will install a stalled page (A) into the\\nPTE and cause data corruption.\\n\\nOne possible callstack is like this:\\n\\nCPU0                                 CPU1\\n----                                 ----\\ndo_swap_page()                       do_swap_page() with same entry\\n\u003cdirect swapin path\u003e                 \u003cdirect swapin path\u003e\\n\u003calloc page A\u003e                       \u003calloc page B\u003e\\nswap_read_folio() \u003c- read to page A  swap_read_folio() \u003c- read to page B\\n\u003cslow on later locks or interrupt\u003e   \u003cfinished swapin first\u003e\\n...                                  set_pte_at()\\n                                     swap_free() \u003c- entry is free\\n                                     \u003cwrite to page B, now page A stalled\u003e\\n                                     \u003cswap out page B to same swap entry\u003e\\npte_same() \u003c- Check pass, PTE seems\\n              unchanged, but page A\\n              is stalled!\\nswap_free() \u003c- page B content lost!\\nset_pte_at() \u003c- staled page A installed!\\n\\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\\nentry content, so even if page (B) is not modified, if swap_read_folio()\\non CPU0 happens later than swap_free() on CPU1, it may also cause data\\nloss.\\n\\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\\nthe cache flag, and allow only one thread to swap it in, also prevent any\\nparallel code from putting the entry in the cache.  Release the pin after\\nPT unlocked.\\n\\nRacers just loop and wait since it\u0027s a rare and very short event.  A\\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\\nfaults wasting too much CPU, causing livelock or adding too much noise to\\nperf statistics.  A similar livelock issue was described in commit\\n029c4628b2eb (\\\"mm: swap: get rid of livelock in swapin readahead\\\")\\n\\nReproducer:\\n\\nThis race issue can be triggered easily using a well constructed\\nreproducer and patched brd (with a delay in read path) [1]:\\n\\nWith latest 6.8 mainline, race caused data loss can be observed easily:\\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\\n  Polulating 32MB of memory region...\\n  Keep swapping out...\\n  Starting round 0...\\n  Spawning 65536 workers...\\n  32746 workers spawned, wait for done...\\n  Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\\n  Round 0 Failed, 15 data loss!\\n\\nThis reproducer spawns multiple threads sharing the same memory region\\nusing a small swap device.  Every two threads updates mapped pages one by\\none in opposite direction trying to create a race, with one dedicated\\nthread keep swapping out the data out using madvise.\\n\\nThe reproducer created a reproduce rate of about once every 5 minutes, so\\nthe race should be totally possible in production.\\n\\nAfter this patch, I ran the reproducer for over a few hundred rounds and\\nno data loss observed.\\n\\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\\nzram:\\n\\nBefore:     10934698 us\\nAfter:      11157121 us\\nCached:     13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\\n\\n[kasong@tencent.com: v4]\\n  Link: https://lkml.kernel.org/r/20240219082040.7495-1-ryncsn@gmail.com\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/swap: corrige la ejecuci\\u00f3n al omitir swapcache Al omitir swapcache para SWP_SYNCHRONOUS_IO, si dos o m\\u00e1s subprocesos intercambian la misma entrada al mismo tiempo, obtienen p\\u00e1ginas diferentes (A, B) . Antes de que un subproceso (T0) finalice el intercambio e instale la p\\u00e1gina (A) en el PTE, otro subproceso (T1) podr\\u00eda finalizar el intercambio de la p\\u00e1gina (B), liberar la entrada y luego intercambiar la p\\u00e1gina posiblemente modificada reutilizando la misma entrada. Rompe el control pte_same (T0) porque el valor de PTE no cambia, lo que provoca un problema de ABA. El subproceso (T0) instalar\\u00e1 una p\\u00e1gina bloqueada (A) en el PTE y provocar\\u00e1 da\\u00f1os en los datos. Una posible pila de llamadas es as\\u00ed: CPU0 CPU1 ---- ---- do_swap_page() do_swap_page() con la misma entrada     swap_read_folio() \u0026lt; - leer en la p\\u00e1gina A swap_read_folio() \u0026lt;- leer en la p\\u00e1gina B   ... set_pte_at() swap_free() \u0026lt;- la entrada es libre   pte_same() \u0026lt;- Verificar pase, PTE parece no haber cambiado, \\u00a1pero la p\\u00e1gina A est\\u00e1 estancada! swap_free() \u0026lt;- \\u00a1Contenido de la p\\u00e1gina B perdido! set_pte_at() \u0026lt;- \\u00a1p\\u00e1gina A obsoleta instalada! Y adem\\u00e1s, para ZRAM, swap_free() permite que el dispositivo de intercambio descarte el contenido de la entrada, por lo que incluso si la p\\u00e1gina (B) no se modifica, si swap_read_folio() en CPU0 ocurre m\\u00e1s tarde que swap_free() en CPU1, tambi\\u00e9n puede causar que los datos p\\u00e9rdida. Para solucionar este problema, reutilice swapcache_prepare, que fijar\\u00e1 la entrada de intercambio usando el indicador de cach\\u00e9 y permitir\\u00e1 que solo un hilo la intercambie, y tambi\\u00e9n evitar\\u00e1 que cualquier c\\u00f3digo paralelo coloque la entrada en el cach\\u00e9. Suelte el pasador despu\\u00e9s de desbloquear el PT. Los corredores simplemente dan vueltas y esperan, ya que es un evento raro y muy corto. Se agrega una llamada Schedule_timeout_uninterruptible(1) para evitar errores repetidos de p\\u00e1gina que desperdician demasiada CPU, provocando bloqueos en vivo o agregando demasiado ruido a las estad\\u00edsticas de rendimiento. Un problema similar de livelock se describi\\u00f3 en el compromiso 029c4628b2eb (\\\"mm: swap: deshacerse de livelock en swapin readahead\\\") Reproductor: este problema de ejecuci\\u00f3n se puede activar f\\u00e1cilmente utilizando un reproductor bien construido y un brd parcheado (con un retraso en la ruta de lectura) [ 1]: Con la \\u00faltima l\\u00ednea principal 6.8, la p\\u00e9rdida de datos causada por la ejecuci\\u00f3n se puede observar f\\u00e1cilmente: $ gcc -g -lpthread test-thread-swap-race.c \u0026amp;\u0026amp; ./a.out Contaminando 32 MB de regi\\u00f3n de memoria... Siga intercambiando. .. Comenzando la ronda 0... Generando 65536 trabajadores... Se generaron 32746 trabajadores, espere a que termine... Ronda 0: Error en 0x5aa00, se esperaban 32746, obtuve 32743, \\u00a13 p\\u00e9rdida de datos! Ronda 0: Error en 0x395200, se esperaba 32746, obtuve 32743, \\u00a13 p\\u00e9rdida de datos! Ronda 0: Error en 0x3fd000, esperado 32746, obtuve 32737, \\u00a19 p\\u00e9rdida de datos! Ronda 0 fallida, \\u00a115 p\\u00e9rdida de datos! Este reproductor genera m\\u00faltiples subprocesos que comparten la misma regi\\u00f3n de memoria mediante un peque\\u00f1o dispositivo de intercambio. Cada dos subprocesos actualiza las p\\u00e1ginas asignadas una por una en direcci\\u00f3n opuesta tratando de crear una ejecuci\\u00f3n, con un subproceso dedicado sigue intercambiando los datos usando madvise. El reproductor cre\\u00f3 una tasa de reproducci\\u00f3n de aproximadamente una vez cada 5 minutos, por lo que la ejecuci\\u00f3n deber\\u00eda ser totalmente posible en producci\\u00f3n. Despu\\u00e9s de este parche, ejecut\\u00e9 el reproductor durante m\\u00e1s de unos cientos de rondas y no se observ\\u00f3 p\\u00e9rdida de datos. ---truncado---\"}]",
      "id": "CVE-2024-26759",
      "lastModified": "2024-11-21T09:03:00.527",
      "published": "2024-04-03T17:15:52.320",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26759\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T17:15:52.320\",\"lastModified\":\"2025-04-16T19:15:50.920\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/swap: fix race when skipping swapcache\\n\\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\\nswapin the same entry at the same time, they get different pages (A, B). \\nBefore one thread (T0) finishes the swapin and installs page (A) to the\\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\\nentry, then swap out the possibly modified page reusing the same entry. \\nIt breaks the pte_same check in (T0) because PTE value is unchanged,\\ncausing ABA problem.  Thread (T0) will install a stalled page (A) into the\\nPTE and cause data corruption.\\n\\nOne possible callstack is like this:\\n\\nCPU0                                 CPU1\\n----                                 ----\\ndo_swap_page()                       do_swap_page() with same entry\\n\u003cdirect swapin path\u003e                 \u003cdirect swapin path\u003e\\n\u003calloc page A\u003e                       \u003calloc page B\u003e\\nswap_read_folio() \u003c- read to page A  swap_read_folio() \u003c- read to page B\\n\u003cslow on later locks or interrupt\u003e   \u003cfinished swapin first\u003e\\n...                                  set_pte_at()\\n                                     swap_free() \u003c- entry is free\\n                                     \u003cwrite to page B, now page A stalled\u003e\\n                                     \u003cswap out page B to same swap entry\u003e\\npte_same() \u003c- Check pass, PTE seems\\n              unchanged, but page A\\n              is stalled!\\nswap_free() \u003c- page B content lost!\\nset_pte_at() \u003c- staled page A installed!\\n\\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\\nentry content, so even if page (B) is not modified, if swap_read_folio()\\non CPU0 happens later than swap_free() on CPU1, it may also cause data\\nloss.\\n\\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\\nthe cache flag, and allow only one thread to swap it in, also prevent any\\nparallel code from putting the entry in the cache.  Release the pin after\\nPT unlocked.\\n\\nRacers just loop and wait since it\u0027s a rare and very short event.  A\\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\\nfaults wasting too much CPU, causing livelock or adding too much noise to\\nperf statistics.  A similar livelock issue was described in commit\\n029c4628b2eb (\\\"mm: swap: get rid of livelock in swapin readahead\\\")\\n\\nReproducer:\\n\\nThis race issue can be triggered easily using a well constructed\\nreproducer and patched brd (with a delay in read path) [1]:\\n\\nWith latest 6.8 mainline, race caused data loss can be observed easily:\\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\\n  Polulating 32MB of memory region...\\n  Keep swapping out...\\n  Starting round 0...\\n  Spawning 65536 workers...\\n  32746 workers spawned, wait for done...\\n  Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\\n  Round 0 Failed, 15 data loss!\\n\\nThis reproducer spawns multiple threads sharing the same memory region\\nusing a small swap device.  Every two threads updates mapped pages one by\\none in opposite direction trying to create a race, with one dedicated\\nthread keep swapping out the data out using madvise.\\n\\nThe reproducer created a reproduce rate of about once every 5 minutes, so\\nthe race should be totally possible in production.\\n\\nAfter this patch, I ran the reproducer for over a few hundred rounds and\\nno data loss observed.\\n\\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\\nzram:\\n\\nBefore:     10934698 us\\nAfter:      11157121 us\\nCached:     13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\\n\\n[kasong@tencent.com: v4]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/swap: corrige la ejecuci\u00f3n al omitir swapcache Al omitir swapcache para SWP_SYNCHRONOUS_IO, si dos o m\u00e1s subprocesos intercambian la misma entrada al mismo tiempo, obtienen p\u00e1ginas diferentes (A, B) . Antes de que un subproceso (T0) finalice el intercambio e instale la p\u00e1gina (A) en el PTE, otro subproceso (T1) podr\u00eda finalizar el intercambio de la p\u00e1gina (B), liberar la entrada y luego intercambiar la p\u00e1gina posiblemente modificada reutilizando la misma entrada. Rompe el control pte_same (T0) porque el valor de PTE no cambia, lo que provoca un problema de ABA. El subproceso (T0) instalar\u00e1 una p\u00e1gina bloqueada (A) en el PTE y provocar\u00e1 da\u00f1os en los datos. Una posible pila de llamadas es as\u00ed: CPU0 CPU1 ---- ---- do_swap_page() do_swap_page() con la misma entrada     swap_read_folio() \u0026lt; - leer en la p\u00e1gina A swap_read_folio() \u0026lt;- leer en la p\u00e1gina B   ... set_pte_at() swap_free() \u0026lt;- la entrada es libre   pte_same() \u0026lt;- Verificar pase, PTE parece no haber cambiado, \u00a1pero la p\u00e1gina A est\u00e1 estancada! swap_free() \u0026lt;- \u00a1Contenido de la p\u00e1gina B perdido! set_pte_at() \u0026lt;- \u00a1p\u00e1gina A obsoleta instalada! Y adem\u00e1s, para ZRAM, swap_free() permite que el dispositivo de intercambio descarte el contenido de la entrada, por lo que incluso si la p\u00e1gina (B) no se modifica, si swap_read_folio() en CPU0 ocurre m\u00e1s tarde que swap_free() en CPU1, tambi\u00e9n puede causar que los datos p\u00e9rdida. Para solucionar este problema, reutilice swapcache_prepare, que fijar\u00e1 la entrada de intercambio usando el indicador de cach\u00e9 y permitir\u00e1 que solo un hilo la intercambie, y tambi\u00e9n evitar\u00e1 que cualquier c\u00f3digo paralelo coloque la entrada en el cach\u00e9. Suelte el pasador despu\u00e9s de desbloquear el PT. Los corredores simplemente dan vueltas y esperan, ya que es un evento raro y muy corto. Se agrega una llamada Schedule_timeout_uninterruptible(1) para evitar errores repetidos de p\u00e1gina que desperdician demasiada CPU, provocando bloqueos en vivo o agregando demasiado ruido a las estad\u00edsticas de rendimiento. Un problema similar de livelock se describi\u00f3 en el compromiso 029c4628b2eb (\\\"mm: swap: deshacerse de livelock en swapin readahead\\\") Reproductor: este problema de ejecuci\u00f3n se puede activar f\u00e1cilmente utilizando un reproductor bien construido y un brd parcheado (con un retraso en la ruta de lectura) [ 1]: Con la \u00faltima l\u00ednea principal 6.8, la p\u00e9rdida de datos causada por la ejecuci\u00f3n se puede observar f\u00e1cilmente: $ gcc -g -lpthread test-thread-swap-race.c \u0026amp;\u0026amp; ./a.out Contaminando 32 MB de regi\u00f3n de memoria... Siga intercambiando. .. Comenzando la ronda 0... Generando 65536 trabajadores... Se generaron 32746 trabajadores, espere a que termine... Ronda 0: Error en 0x5aa00, se esperaban 32746, obtuve 32743, \u00a13 p\u00e9rdida de datos! Ronda 0: Error en 0x395200, se esperaba 32746, obtuve 32743, \u00a13 p\u00e9rdida de datos! Ronda 0: Error en 0x3fd000, esperado 32746, obtuve 32737, \u00a19 p\u00e9rdida de datos! Ronda 0 fallida, \u00a115 p\u00e9rdida de datos! Este reproductor genera m\u00faltiples subprocesos que comparten la misma regi\u00f3n de memoria mediante un peque\u00f1o dispositivo de intercambio. Cada dos subprocesos actualiza las p\u00e1ginas asignadas una por una en direcci\u00f3n opuesta tratando de crear una ejecuci\u00f3n, con un subproceso dedicado sigue intercambiando los datos usando madvise. El reproductor cre\u00f3 una tasa de reproducci\u00f3n de aproximadamente una vez cada 5 minutos, por lo que la ejecuci\u00f3n deber\u00eda ser totalmente posible en producci\u00f3n. Despu\u00e9s de este parche, ejecut\u00e9 el reproductor durante m\u00e1s de unos cientos de rondas y no se observ\u00f3 p\u00e9rdida de datos. ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"6.1.80\",\"matchCriteriaId\":\"1D4BFAE6-78E1-4617-99B6-12994681E95C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.19\",\"matchCriteriaId\":\"8D82004C-B2AE-4048-9344-32EFF65953B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.7\",\"matchCriteriaId\":\"575EE16B-67F2-4B5B-B5F8-1877715C898B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.279Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26759\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-08T14:03:53.009974Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:22.409Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"mm/swap: fix race when skipping swapcache\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0bcac06f27d7528591c27ac2b093ccd71c5d0168\", \"lessThan\": \"2dedda77d4493f3e92e414b272bfa60f1f51ed95\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bcac06f27d7528591c27ac2b093ccd71c5d0168\", \"lessThan\": \"305152314df82b22cf9b181f3dc5fc411002079a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bcac06f27d7528591c27ac2b093ccd71c5d0168\", \"lessThan\": \"d183a4631acfc7af955c02a02e739cec15f5234d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bcac06f27d7528591c27ac2b093ccd71c5d0168\", \"lessThan\": \"13ddaf26be324a7f951891ecd9ccd04466d27458\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/swap.h\", \"mm/memory.c\", \"mm/swap.h\", \"mm/swapfile.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.80\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/swap.h\", \"mm/memory.c\", \"mm/swap.h\", \"mm/swapfile.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95\"}, {\"url\": \"https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a\"}, {\"url\": \"https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d\"}, {\"url\": \"https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/swap: fix race when skipping swapcache\\n\\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\\nswapin the same entry at the same time, they get different pages (A, B). \\nBefore one thread (T0) finishes the swapin and installs page (A) to the\\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\\nentry, then swap out the possibly modified page reusing the same entry. \\nIt breaks the pte_same check in (T0) because PTE value is unchanged,\\ncausing ABA problem.  Thread (T0) will install a stalled page (A) into the\\nPTE and cause data corruption.\\n\\nOne possible callstack is like this:\\n\\nCPU0                                 CPU1\\n----                                 ----\\ndo_swap_page()                       do_swap_page() with same entry\\n\u003cdirect swapin path\u003e                 \u003cdirect swapin path\u003e\\n\u003calloc page A\u003e                       \u003calloc page B\u003e\\nswap_read_folio() \u003c- read to page A  swap_read_folio() \u003c- read to page B\\n\u003cslow on later locks or interrupt\u003e   \u003cfinished swapin first\u003e\\n...                                  set_pte_at()\\n                                     swap_free() \u003c- entry is free\\n                                     \u003cwrite to page B, now page A stalled\u003e\\n                                     \u003cswap out page B to same swap entry\u003e\\npte_same() \u003c- Check pass, PTE seems\\n              unchanged, but page A\\n              is stalled!\\nswap_free() \u003c- page B content lost!\\nset_pte_at() \u003c- staled page A installed!\\n\\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\\nentry content, so even if page (B) is not modified, if swap_read_folio()\\non CPU0 happens later than swap_free() on CPU1, it may also cause data\\nloss.\\n\\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\\nthe cache flag, and allow only one thread to swap it in, also prevent any\\nparallel code from putting the entry in the cache.  Release the pin after\\nPT unlocked.\\n\\nRacers just loop and wait since it\u0027s a rare and very short event.  A\\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\\nfaults wasting too much CPU, causing livelock or adding too much noise to\\nperf statistics.  A similar livelock issue was described in commit\\n029c4628b2eb (\\\"mm: swap: get rid of livelock in swapin readahead\\\")\\n\\nReproducer:\\n\\nThis race issue can be triggered easily using a well constructed\\nreproducer and patched brd (with a delay in read path) [1]:\\n\\nWith latest 6.8 mainline, race caused data loss can be observed easily:\\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\\n  Polulating 32MB of memory region...\\n  Keep swapping out...\\n  Starting round 0...\\n  Spawning 65536 workers...\\n  32746 workers spawned, wait for done...\\n  Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\\n  Round 0 Failed, 15 data loss!\\n\\nThis reproducer spawns multiple threads sharing the same memory region\\nusing a small swap device.  Every two threads updates mapped pages one by\\none in opposite direction trying to create a race, with one dedicated\\nthread keep swapping out the data out using madvise.\\n\\nThe reproducer created a reproduce rate of about once every 5 minutes, so\\nthe race should be totally possible in production.\\n\\nAfter this patch, I ran the reproducer for over a few hundred rounds and\\nno data loss observed.\\n\\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\\nzram:\\n\\nBefore:     10934698 us\\nAfter:      11157121 us\\nCached:     13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\\n\\n[kasong@tencent.com: v4]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.80\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.19\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:03:37.459Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26759\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:03:37.459Z\", \"dateReserved\": \"2024-02-19T14:20:24.170Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:43.288Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.