CVE-2026-89760

A flaw was found in the Linux kernel's memory management (mm) and swap subsystem. This vulnerability occurs when the swap_free_hibernation_slot() function incorrectly frees a hibernation slot while a memory page (folio) is still present in the swap cache. This can lead to silent memory corruption, process crashes, or data instability across unrelated user applications, typically during the preparation of a hibernation image by uswsusp.

A moderate impact flaw was found in the Linux kernel's memory management (mm) and swap subsystem. The swap_free_hibernation_slot() function incorrectly frees a hibernation swap slot while a folio is still present in the swap cache. This can occur after swap cluster readahead places a folio on the slot, because a hibernation slot passes the __swap_cache_add_check() test. Once the slot is freed, its offset is returned to the swap allocator while the folio remains on the LRU list; when memory reclaim later writes that folio back out using its stale folio->swap offset, it can overwrite a swap table entry that has by then been reallocated to another user. The result can be silent memory corruption, process crashes, or data instability across completely unrelated applications, typically triggered while uswsusp prepares the hibernation image. Exploitation requires local access and depends on specific timing and memory state conditions, so Red Hat rates this flaw moderate impact (CVSS 3.1 score of 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the upstream CVEORG score of 7.8 primarily due to the higher attack complexity. Red Hat Enterprise Linux 6 is out of support scope, and the Red Hat Enterprise Linux 7, 8, 9, and 10 kernels do not contain the vulnerable code and are therefore not affected. Red Hat OpenShift Container Platform 4 RHEL CoreOS builds are likewise not affected. Red Hat OpenShift Container Platform 5.0 and 5.1 (RHEL CoreOS 9) are affected; the fix on those streams is currently deferred, so systems using swap and hibernation there remain at residual risk of memory corruption, although practical exposure is limited because triggering the flaw requires the specific race between hibernation slot freeing and swap cluster readahead on a hibernating system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.