Skip to main content

Linux Kernel CVE-2026-64415

| EUVDEUVD-2026-48959 MEDIUM
Improper Locking (CWE-667)
2026-07-25 Linux GHSA-f2f9-54cv-v7gf
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects the non-trivial prerequisite of a large swap device under sustained extreme stress load; no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 16:07 vuln.today
CVSS changed
Sep 04, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup

We hit a real softlockup in an internal stress test environment. The workload was LTP memory/swap stress on a large arm64 machine, with 320 CPUs, about 1TB memory and an 8.6GB swap device. The system was under heavy load and the swap device had a large number of full clusters. The softlockup was triggered during a stress test after about 3 days.

So, add periodic cond_resched() calls during large full_clusters reclaim operations to prevent softlockup issues.

Detailed call trace as follow:

PID: 3817773 TASK: ffff0883bb28b780 CPU: 48 COMMAND: "kworker/48:7" #0 [ffff800080183d10] __crash_kexec at ffffa4c1361e5de4 #1 [ffff800080183d90] panic at ffffa4c1360d5e9c #2 [ffff800080183e20] watchdog_timer_fn at ffffa4c136231fa8 ... #16 [ffff8000c4ad3cb0] swap_cache_del_folio at ffffa4c1363e1614 #17 [ffff8000c4ad3ce0] __try_to_reclaim_swap at ffffa4c1363e4bfc #18 [ffff8000c4ad3d40] swap_reclaim_full_clusters at ffffa4c1363e5474 #19 [ffff8000c4ad3da0] swap_reclaim_work at ffffa4c1363e550c #20 [ffff8000c4ad3dc0] process_one_work at ffffa4c136102edc #21 [ffff8000c4ad3e10] worker_thread at ffffa4c136103398 #22 [ffff8000c4ad3e70] kthread at ffffa4c13610d95c

AnalysisAI

Softlockup in the Linux kernel's swap memory reclaim path allows a local user to trigger a kernel panic by generating heavy swap pressure on systems with large swap devices. The swap_reclaim_full_clusters() function, called from a kworker context, iterates through potentially thousands of full swap clusters without yielding the CPU via cond_resched(), starving the scheduler and eventually causing the kernel watchdog timer to fire. The vulnerability was confirmed in a real-world stress test on a 320-CPU arm64 machine with ~1TB RAM and an 8.6GB swap device, resulting in a kernel panic. No public exploit code exists and EPSS is very low (0.21%, 11th percentile).

Technical ContextAI

The affected code is in the Linux kernel mm/swap subsystem, specifically the swap_reclaim_full_clusters() function called from swap_reclaim_work(), which runs in a kworker thread. When a swap device accumulates a large number of full clusters under heavy memory pressure, the reclaim loop iterates through all of them in a tight loop without invoking cond_resched(), the standard kernel yield primitive that allows voluntary CPU preemption between long operations. CWE-667 (Improper Locking / Resource Locking) is the assigned class, though the precise root cause is a missing schedule point causing CPU starvation. Affected kernel commits begin at 5168a68eb78fa1c67a8b2d31d0642c7fd866cc12, which introduced this code path. CPE cpe:2.3:a:linux:linux:* applies broadly; narrowed to kernels containing that commit and prior to the four stable-tree fixes.

RemediationAI

Upgrade to a patched kernel version: Linux 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1, which add periodic cond_resched() calls in swap_reclaim_full_clusters() to yield the CPU during large full-cluster reclaim operations. Fixes are available at https://git.kernel.org/stable/c/60cbe67d1342f34b66df1c2ee328e3cd333767d7, https://git.kernel.org/stable/c/69c0e6246575b780ae0d3f411c749bcf13c221f3, https://git.kernel.org/stable/c/2a55fdf9f746a1a6ced7fd62ea1080b8a917e0b0, and https://git.kernel.org/stable/c/66366d291f666ddeda5f8c84f253e308de3e6b55. On unpatched systems, reducing /proc/sys/vm/swappiness to a low value (e.g., 10) decreases the kernel's eagerness to push pages to swap, reducing the likelihood of accumulating large numbers of full clusters - though this trade-off increases OOM kill frequency under genuine memory pressure. Reducing swap partition size below the threshold at which full-cluster accumulation becomes problematic is another option, with the trade-off of reduced memory overcommit capacity.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-64415 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy