CVE-2026-98226

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count

SWAP_USAGE_OFFLIST_BIT is embedded in the si->inuse_pages usage counter,

and is meant to sit above any value that counter can reach. However, it

is defined from BITS_PER_TYPE(atomic_t), so it is bit 30. On a system

with 4 KiB pages the flag collides with the usage count once that count

reaches 4 TiB.

swap_usage_in_pages() masks bit 30 out, so whenever the real count has

that bit set, every caller of it reads 4 TiB low:

* /proc/swaps understates Used by 4 TiB.

* A raw count of exactly 2^30 masks to zero, so try_to_unuse() takes its

"if (!swap_usage_in_pages(si)) goto success;" early exit and swapoff

tears the device down while pages are still swapped out. Nothing in

the rest of swapoff aborts the teardown, so those pages are lost.

Independently of swapoff, the collision also corrupts the counter and the

plist. On a device in normal use,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References