Executive brief
A vulnerability exists in the Linux kernel's shared memory (shmem) subsystem during file renaming operations. Under conditions of extreme memory pressure, the system may fail to correctly track file locations, potentially leading to system instability or data inconsistency. This affects how the operating system manages temporary files and shared memory used by various applications.
Technical details
A vulnerability in the Linux kernel's shmem implementation arises from improper error handling in simple_offset_rename() and simple_offset_rename_exchange(). When the system is under severe memory pressure, maple_tree insertions can fail. If these failures occur during a rename operation, especially after a successful shmem_whiteout(), the kernel does not recover gracefully, leading to an inconsistent state. The fix involves pre-inserting targets into the maple_tree within shmem_rename2() to ensure that subsequent operations do not fail due to memory allocation issues after critical state changes have already occurred.
Affected products
- Linux Linux Kernel 6.6 to 6.12.64, 6.13 to 6.18.3
Timeline
- 2025-12-13: other: Initial patch authored
- 2026-01-02: patched: Patch committed to stable tree
- 2026-01-13: disclosed: CVE published