Executive brief
The Linux kernel's zsmalloc memory allocator has a race condition that causes list corruption under memory pressure. When the system is actively compressing and reclaiming memory simultaneously, the LRU (Least Recently Used) list can become corrupted, leading to kernel crashes and system instability.
Technical details
The zsmalloc allocator performs LRU list updates at object mapping time (zs_map_object) rather than at allocation time (zs_malloc), deviating from other zswap backends. This creates a race condition when concurrent store and reclaim operations interleave: a store operation allocates a zspage and releases the pool lock, while concurrently a reclaim operation acquires the lock and selects the same zspage from the LRU list for reclamation. This causes list_del_entry to detect corruption (LIST_POISON1 marker) when the first operation tries to update the LRU list. The root cause is the gap between object allocation and LRU list update, which exposes the zspage to selection by reclaim logic. The fix relocates the LRU update from zs_map_object() to zs_malloc() to close this window.
Affected products
- Linux kernel 5.19.0 and related versions
Timeline
- 2025-12-30: disclosed: CVE-2023-54165 published
- 2023: other: Issue introduced in kernel version 5.19.0