CVE-2026-89760

A moderate impact flaw was found in the Linux kernel's memory management (mm) and swap subsystem. The swap_free_hibernation_slot() function incorrectly frees a hibernation swap slot while a folio is still present in the swap cache. This can occur after swap cluster readahead places a folio on the slot, because a hibernation slot passes the __swap_cache_add_check() test. Once the slot is freed, its offset is returned to the swap allocator while the folio remains on the LRU list; when memory reclaim later writes that folio back out using its stale folio->swap offset, it can overwrite a swap table entry that has by then been reallocated to another user. The result can be silent memory corruption, process crashes, or data instability across completely unrelated applications, typically triggered while uswsusp prepares the hibernation image. Exploitation requires local access and depends on specific timing and memory state conditions, so Red Hat rates this flaw moderate impact (CVSS 3.1 score of 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the upstream CVEORG score of 7.8 primarily due to the higher attack complexity. Red Hat Enterprise Linux 6 is out of support scope, and the Red Hat Enterprise Linux 7, 8, 9, and 10 kernels do not contain the vulnerable code and are therefore not affected. Red Hat OpenShift Container Platform 4 RHEL CoreOS builds are likewise not affected. Red Hat OpenShift Container Platform 5.0 and 5.1 (RHEL CoreOS 9) are affected; the fix on those streams is currently deferred, so systems using swap and hibernation there remain at residual risk of memory corruption, although practical exposure is limited because triggering the flaw requires the specific race between hibernation slot freeing and swap cluster readahead on a hibernating system.