Technical impact
The Linux kernel’s memory‑management subsystem contains a race condition in the shared‑memory (shmem) swap‑freeing routine. The helper obtains the order of a swap entry with xa_get_order outside a lock and later performs an atomic compare‑and‑swap to delete the entry. If the entry is split or otherwise modified between these two steps, the order value becomes stale. The stale order can cause the helper to truncate data beyond the intended end boundary or leave a swap entry uncleared, resulting in kernel memory corruption and potentially a panic when swapoff is called.
Affected Systems
The flaw exists in the Linux kernel itself, specifically in versions 6.19 release candidates rc1 through rc7. Systems running these kernels and utilizing the shmem swap facility are potentially vulnerable.
Risk and Exploitability
The CVSS score of 7.3 indicates a high‑severity impact. The EPSS score is reported as < 1 % and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require a precise race between truncation of a region and modification of a swap entry; such a race is technically possible but practically difficult to trigger from user space. The risk is therefore primarily a denial‑of‑service scenario rather than privilege escalation.
Ubuntu USN