CVE-2026-98226

A flaw was found in the Linux kernel's swap subsystem. An internal tracking bit overlaps with the active page counter when swap utilization reaches very large capacities, causing the kernel to miscalculate active swap space. A local user capable of allocating enough memory to reach this threshold can trigger the collision, leading to premature swap deactivation and data loss. This inconsistency can also corrupt internal device tracking lists, resulting in system instability and a Denial of Service (DoS).

The swap usage flag occupied bit 30 of an atomic_long_t counter because its position was incorrectly derived from the narrower atomic_t type. On a system with 4 KiB pages the flag collides with the real usage count when 4 TiB of swap is in use. The masked count can become zero while swapped pages remain, allowing swapoff to tear down the device and lose page contents. A separate free path can mistake the real counter bit for the off list flag, reduce the stored count by 4 TiB, and add an existing node to the plist for a second time. This causes incorrect swap accounting, a WARN, and corruption of the plist structure. For the CVSS the PR:L reflects that a local user can contribute to extreme swap consumption when memory controls permit, although configuring the swap device and directly invoking swapoff normally require administrative access. AC:H reflects the exceptional swap size and counter state required for triggering. The issue is not network reachable. Impact includes loss of swapped pages, process or system failure, and possible security impact from subsequent traversal of the corrupted kernel list. The confirmed impact is integrity and availability loss.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.