CVE-2026-23211: Linux Kernel DoS Vulnerability

CVE-2026-23211 Overview

A kernel panic vulnerability exists in the Linux kernel's memory management subsystem related to swap address space handling. The issue was introduced when commit 8b47299a411a made the swap address space read-only as part of a security hardening measure. However, this change can lead to a kernel panic condition when arch_prepare_to_swap returns a failure under heavy memory pressure scenarios.

Critical Impact

Systems under heavy memory pressure may experience kernel panics, leading to complete system unavailability and potential data loss from interrupted operations.

Affected Products

• Linux Kernel (versions with commit 8b47299a411a applied)
• Systems experiencing high memory pressure with swap enabled
• ARM64 architecture systems (based on call stack indicators)

Discovery Timeline

• February 18, 2026 - CVE-2026-23211 published to NVD
• February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23211

Vulnerability Analysis

This vulnerability represents a Denial of Service condition triggered by improper handling of swap address space attributes in the Linux kernel's memory management code. The root issue stems from a prior security enhancement (commit 8b47299a411a) that marked swap address space as read-only with added context debug checks. While this was intended to improve security, it created an unintended failure path when memory allocation routines encounter specific error conditions.

When the kernel is under heavy memory pressure and needs to reclaim pages by swapping them to disk, the arch_prepare_to_swap function may fail. Under normal circumstances, this failure would be handled gracefully. However, with the swap address space marked as read-only, the error handling path triggers an exception when attempting to set writeback errors via __filemap_set_wb_err, ultimately resulting in a kernel panic.

Root Cause

The root cause lies in the interaction between the read-only swap address space attribute and the error handling code path in shrink_folio_list. When arch_prepare_to_swap fails during memory reclamation under high pressure, the kernel attempts to record the error using errseq_set through __filemap_set_wb_err. This write operation conflicts with the read-only attribute set on the swap address space, triggering an el1_abort exception on ARM64 systems that propagates up the call stack and causes a kernel panic.

Attack Vector

The vulnerability is triggered through resource exhaustion conditions rather than direct exploitation. An attacker or adverse system conditions that cause heavy memory pressure can indirectly trigger this panic. The attack scenario involves:

1. System enters a high memory pressure state
2. Kernel initiates aggressive page reclamation via try_to_free_pages
3. The shrink_folio_list function attempts to swap out pages
4. arch_prepare_to_swap fails due to resource constraints
5. Error recording via __filemap_set_wb_err triggers a write to read-only memory
6. ARM64 systems generate an el1_abort exception
7. Kernel panics due to unhandled exception

The panic call stack demonstrates this flow through functions including shrink_folio_list, evict_folios, try_to_shrink_lruvec, and ultimately __alloc_pages_slowpath during memory allocation under pressure.

Detection Methods for CVE-2026-23211

Indicators of Compromise

• Kernel panic messages containing el1_abort or el1h_64_sync_handler on ARM64 systems
• Crash dumps showing errseq_set or __filemap_set_wb_err in the call stack
• System crashes occurring during periods of high memory utilization with active swap usage
• Presence of shrink_folio_list and evict_folios in kernel oops traces

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for abort exceptions related to memory management operations
• Implement crash dump analysis to identify panic patterns matching the swap address space attribute issue
• Track memory pressure events using Linux kernel memory cgroup statistics and swap utilization metrics
• Deploy kernel event tracing on arch_prepare_to_swap failure paths in development and staging environments

Monitoring Recommendations

• Configure kernel crash dump collection (kdump) to capture diagnostic information when panics occur
• Set up alerts for high swap utilization combined with memory pressure indicators
• Monitor system stability metrics including uptime and unplanned restart events
• Review kernel version and patch levels against affected versions in deployment inventory

How to Mitigate CVE-2026-23211

Immediate Actions Required

• Update Linux kernel to patched versions that restore proper swap address space attributes
• Review memory allocation configurations on systems experiencing high memory pressure
• Ensure kernel crash dump collection is enabled for diagnostic purposes
• Consider increasing swap space or physical memory to reduce pressure scenarios

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability by restoring the swap address space to its previous (non-read-only) state. The fix prevents the kernel panic by allowing error recording operations to complete successfully.

Official patch commits are available:

• Kernel Git Commit - Patch (commit a0f3c0845a4f)
• Kernel Git Commit - Update (commit b0020cbd2638)

Apply the appropriate patch from stable kernel branches or upgrade to a kernel version containing these fixes.

Workarounds

• Reduce memory pressure by increasing physical RAM or swap capacity to lower the likelihood of triggering the vulnerable code path
• Configure memory overcommit settings (vm.overcommit_memory, vm.overcommit_ratio) to reduce aggressive memory allocation scenarios
• Monitor and manage memory-intensive workloads to prevent sustained high memory pressure
• Consider disabling swap temporarily on critical systems if memory resources permit, until patching is complete

# Temporary workaround: Adjust memory overcommit settings
# Reduce likelihood of triggering memory pressure conditions
echo 2 > /proc/sys/vm/overcommit_memory
echo 80 > /proc/sys/vm/overcommit_ratio

# Monitor swap usage and memory pressure
cat /proc/meminfo | grep -E "Swap|MemAvailable"
cat /proc/pressure/memory