CVE-2024-26960

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: swap: fix race between free_swap_and_cache() and swapoff()

There was previously a theoretical window where swapoff() could run and

teardown a swap_info_struct while a call to free_swap_and_cache() was

running in another thread. This could cause, amongst other bad

possibilities, swap_page_trans_huge_swapped() (called by

free_swap_and_cache()) to access the freed memory for swap_map.

This is a theoretical problem and I haven't been able to provoke it from a

test case. But there has been agreement based on code review that this is

possible (see link below).

Fix it by using get_swap_device()/put_swap_device(), which will stall

swapoff(). There was an extra check in _swap_info_get() to confirm that

the swap entry was not free. This isn't present in get_swap_device()

because it doesn't make sense in general due to the race between getting

the reference and swapoff. So I've added an equivalent check directly in

f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References