CVE-2026-23161

A race condition was found in the Linux kernel's shmem/swap handling during truncate operations. The swap entry order is retrieved without proper lock protection, allowing it to become stale before the subsequent xa_cmpxchg_irq operation. This can cause truncation to erase data beyond the intended end border or lead to swapoff hangs and kernel panics.

This race condition requires specific timing between truncate operations and swap entry splits under ZSWAP stress. While it can cause kernel panics, it's difficult to trigger reliably and primarily affects systems using ZSWAP with shmem/tmpfs under heavy memory pressure. No data confidentiality or integrity impact beyond the crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.