Executive brief
A memory management bug in the Linux kernel's swap subsystem can cause silent memory corruption, application crashes, or data instability when the system uses hibernation. The vulnerability occurs because hibernation slot cleanup does not check whether a cached memory page is still in use, allowing the slot to be freed prematurely and causing data to be written to the wrong memory locations. This can affect unrelated applications and is typically triggered when hibernation preparation (uswsusp) is in progress.
Technical details
This is a use-after-free / memory corruption vulnerability in the Linux kernel's swap management layer, specifically in swap_free_hibernation_slot(). The vulnerable component fails to check whether a folio (memory page) exists in the swap cache before freeing a hibernation slot, whereas swap_put_entries_cluster() correctly performs this check. Cluster readahead can place a folio in the slot; when swap_free_hibernation_slot() incorrectly frees the slot, the folio becomes unreachable via the swap table but remains on the LRU. Subsequent memory reclaim operations then use the now-freed offset to overwrite swap table entries belonging to other processes. The fix adds a check for cached folios before freeing the slot, allowing it to be freed only when the folio leaves the cache. No public exploit reports exist, though the vulnerability can be triggered during hibernation image preparation.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Fix checks for cached folio before freeing hibernation slot