CVE-2024-26832

mm: zswap: fix missing folio cleanup in writeback race path

published April 17, 2024

CVSS
—
EPSS
0%
Percentile
12.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mm: zswap: fix missing folio cleanup in writeback race path

In zswap_writeback_entry(), after we get a folio from

__read_swap_cache_async(), we grab the tree lock again to check that the

swap entry was not invalidated and recycled. If it was, we delete the

folio we just added to the swap cache and exit.

However, __read_swap_cache_async() returns the folio locked when it is

newly allocated, which is always true for this path, and the folio is

ref'd. Make sure to unlock and put the folio before returning.

This was discovered by code inspection, probably because this path handles

a race condition that should not happen often, and the bug would not crash

the system, it will only strand the folio indefinitely.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00222 · 12.1th percentile
Published
2024-04-17T10:10Z
EPSS history
Timeline
  • 17 APR 10:10Z
    mm: zswap: fix missing folio cleanup in writeback race path
    cvelistv5