CVE-2026-23161: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23161 is a race condition vulnerability in the Linux kernel's shared memory (shmem) and swap subsystem, specifically in the helper function responsible for freeing shmem swap entries. The flaw arises because the swap entry order is retrieved via xa_get_order without lock protection before the entry is erased with xa_cmpxchg_irq, creating a window where concurrent operations can alter the entry state. Affected kernel versions include 6.12.0 through 6.12.68, 6.13 through 6.18.8, and 6.19-rc1 through 6.19-rc7. It carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly).

The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). In the shmem swap freeing helper, xa_get_order is called outside of a critical section to retrieve the order of a swap entry, then xa_cmpxchg_irq is used to erase it. Between these two operations, a concurrent thread can split or replace the swap entry — for example, by swapping in or freeing adjacent entries and then inserting a large folio that reuses the same swap slot — causing the stale order value to be used. In the worst case, this causes truncation to erase data beyond the intended end border. The fix moves order retrieval and value checking into the same lock-protected critical section and adds a guard to ensure the order does not exceed the end border (Feedly, Kernel Patch 1).

Successful exploitation can cause system hangs and kernel panics, particularly when ZSWAP (zero-page swap) is used in conjunction with shmem operations under stress. The vulnerability is limited to availability impact — there is no confidentiality or integrity exposure beyond potential data erasure within the swap subsystem. A local attacker with low privileges could trigger denial of service by inducing the race condition, though reliable exploitation requires precise timing (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.017%, reflecting very low probability of exploitation in the near term. The vulnerability requires local access with low privileges and high attack complexity due to the precise timing needed to win the race condition. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Update the Linux kernel to a patched version: 6.12.69 or later, 6.18.9 or later, or 6.19-rc8 or later. Patches are available in the upstream stable kernel tree. Systems using ZSWAP with shmem workloads on vulnerable kernel versions (6.12.0–6.12.68, 6.13–6.18.8, 6.19-rc1–rc7) should prioritize patching. Oracle Linux users can refer to vendor advisories (ELSA-2026-50160 and ELSA-2026-50232) for distribution-specific updates (Feedly, Oracle Advisory 1, Oracle Advisory 2).