CVE-2026-89760: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89760 Overview

CVE-2026-89760 is a memory management flaw in the Linux kernel's swap subsystem. The function swap_free_hibernation_slot() frees a swap slot without checking whether a folio in the swap cache references it. Cluster readahead can place a folio on a hibernation slot because the slot passes __swap_cache_add_check(). When the slot is later freed, the folio becomes unreachable from the swap table, but remains on the LRU. Reclaim can then overwrite an unrelated swap table entry using the stale offset stored in folio->swap.

Critical Impact
The bug can trigger silent memory corruption, process crashes, or data instability across unrelated userspace applications, typically during uswsusp hibernation image preparation.

Affected Products

Linux kernel (mainline versions containing the vulnerable swap_free_hibernation_slot() implementation)
Distributions shipping the affected mm/swap code path
Systems using userspace software suspend (uswsusp) for hibernation

Discovery Timeline

2026-09-11 - CVE-2026-89760 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89760

Vulnerability Analysis

The flaw resides in the Linux kernel memory management swap code. A swap slot holding a folio in the swap cache must only be freed when the folio leaves the cache, not when its reference count reaches zero. swap_put_entries_cluster() observes this invariant. swap_free_hibernation_slot() violates it by calling __swap_cluster_free_entries() unconditionally, regardless of whether a folio currently sits on the slot.

Cluster readahead compounds the issue. It scans a page_cluster sized window of offsets around the faulting entry. A hibernation slot passes the __swap_cache_add_check() test because it is not a folio and its count is non-zero. Readahead then attaches a folio to the slot. When swap_free_hibernation_slot() subsequently frees the slot, it clears the swap table entry underneath that folio.

The folio is now orphaned from the swap table but still linked on the LRU. Later reclaim retrieves the stale offset from folio->swap and overwrites whatever swap table entry now occupies that offset, corrupting data belonging to unrelated processes.

Root Cause

The root cause is a missing precondition check in swap_free_hibernation_slot(). The function does not verify whether the target slot has an associated folio in the swap cache before releasing the slot to the allocator. This breaks the swap cache ownership contract enforced elsewhere in the subsystem.

Attack Vector

Exploitation requires local access with the ability to trigger hibernation preparation, typically via uswsusp. The condition is a race between hibernation slot allocation, cluster readahead placing a folio on the slot, and the subsequent slot free. Successful triggering results in cross-process memory corruption without any elevated capability beyond invoking the hibernation path.

See the upstream fixes for technical details: Kernel Git Commit 10d9012 and Kernel Git Commit a6df7315.

Detection Methods for CVE-2026-89760

Indicators of Compromise

Unexplained process crashes, SIGSEGV, or SIGBUS signals in unrelated userspace applications occurring near hibernation events.
Silent data corruption in files or memory-mapped regions following a uswsusp hibernation image preparation.
Kernel log entries referencing swap cache inconsistencies, LRU anomalies, or bad swap entries after resume.

Detection Strategies

Correlate application crash telemetry with systemd-logind or pm-hibernate events on hosts that use hibernation.
Inspect kernel ring buffer output via dmesg for warnings from the swap subsystem, particularly around swap_free_hibernation_slot or swap table integrity checks.
Track kernel package versions across the fleet and flag hosts running vulnerable mm/swap code paths.

Monitoring Recommendations

Ingest dmesg and journald data into a centralized log store and alert on swap or memory management warnings tied to hibernation lifecycle events.
Monitor for repeated unrelated userspace crashes on the same host within short windows following resume from hibernation.
Baseline kernel versions across Linux endpoints and workloads and alert on drift from patched builds.

How to Mitigate CVE-2026-89760

Immediate Actions Required

Apply the upstream kernel patches referenced in Kernel Git Commit 10d9012 and Kernel Git Commit a6df7315 via distribution updates.
Identify Linux hosts and workloads that use uswsusp or any hibernation workflow and prioritize them for patching.
Reboot patched systems to load the fixed kernel image.

Patch Information

The fix adds a check for a cached folio before freeing the hibernation slot. When a folio sits in the swap cache on the slot, the slot is left in the ordinary state where only the swap cache references it. The slot is then freed when the folio leaves the cache, either through the immediate reclaim path or through normal reclaim later. Apply vendor-supplied kernel updates that incorporate the commits listed above.

Workarounds

Disable hibernation on affected hosts by masking the hibernate.target systemd unit or removing the resume= parameter until the patched kernel is deployed.
Avoid using uswsusp and userspace hibernation tooling on unpatched systems.
Where hibernation is required, restrict local access so that only trusted administrators can invoke the hibernation code path.

bash

# Configuration example: disable hibernation targets pending kernel patch
sudo systemctl mask hibernate.target suspend-then-hibernate.target hybrid-sleep.target

# Verify running kernel version against patched build
uname -r