CVE-2026-89760: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89760 is a Linux kernel memory corruption vulnerability caused by improper handling of hibernation slots in the swap cache. Specifically, swap_free_hibernation_slot() incorrectly frees a hibernation slot even when a folio is present in the swap cache, violating the rule followed by swap_put_entries_cluster(). This can lead to silent memory corruption, process crashes, or data instability across unrelated userspace applications, particularly during hibernation image preparation by utilities such as uswsusp. Affected kernel versions begin at commit 0d6af9bcf383 up to (but not including) the fix commits, with Linux kernel 7.1 confirmed affected and versions prior to 7.1 or 7.2.4+ unaffected. The vulnerability is rated HIGH severity by Feedly's CVSS category estimate (Red Hat Advisory, Red Hat Bugzilla, Github Advisory).

The root cause is classified as CWE-825 (Expired Pointer Dereference), arising from swap_free_hibernation_slot() calling __swap_cluster_free_entries() unconditionally, without first checking whether a folio occupies the slot in the swap cache. Cluster readahead can place a folio into a hibernation slot because the slot passes __swap_cache_add_check() validation — it is not treated as a normal folio and its reference count is non-zero. When the slot is freed prematurely, the swap table entry is cleared while the folio remains on the LRU; subsequent memory reclaim then reads the stale offset from folio->swap and overwrites whatever swap table entry now occupies that location, corrupting kernel memory state. The fix requires checking for a cached folio before freeing the slot, leaving it in the ordinary swap-cache-held state until the folio naturally leaves the cache (Red Hat Bugzilla, Github Advisory).

Successful exploitation can result in silent memory corruption, unexpected process crashes, and data instability that may affect completely unrelated userspace applications running on the same system. Because the corrupted swap table entry can be reallocated to another process, the impact can cross process boundaries, potentially exposing or corrupting data belonging to other users or services. The vulnerability is most likely to manifest during hibernation image preparation (e.g., via uswsusp), but the resulting corruption can persist and affect system stability well beyond the hibernation event (Red Hat Bugzilla, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. Exploitation requires local access and the ability to trigger hibernation or suspend operations on the affected system. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution has been reported. No EPSS score data was available in the provided sources (Red Hat Advisory, Github Advisory).

Apply the upstream Linux kernel patches that correct swap_free_hibernation_slot() to check for a cached folio before freeing the slot; the fix commits are a6df73156f2d85746c69adbf13d0f5ea200e0626 and 10d9012e83efedde8718ceaa5053f836e0c8596c in the stable kernel tree. Linux kernel 7.2.4 and later (7.2.x branch) and 7.3-rc1 onward are unaffected. As an interim workaround where patching is not immediately possible, consider restricting hibernation and suspend capabilities to trusted users only, and monitor systems for unexpected swap-related memory corruption or process crashes during hibernation operations (Red Hat Bugzilla, Github Advisory).

The vulnerability was discovered by a kernel developer while working on a related improvement to hibernation slot tracking in the swap table, and was discussed with Kairui Song on the linux-mm mailing list prior to disclosure. The Red Hat security team triaged the issue at medium priority/severity. No significant broader media coverage or notable public researcher commentary beyond the kernel community discussion has been observed (Red Hat Bugzilla, Linux MM Mailing List).