{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98226 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98226 is a vulnerability in Linux, published on 6 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-98226 and fix it if it is affected.\n\nWhat it is: CVE-2026-98226 is a vulnerability in Linux, published on 6 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-98226 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98226/ (Markdown: https://insights.sbomify.com/CVE-2026-98226/index.md)","id":"CVE-2026-98226","markdown":"https://insights.sbomify.com/CVE-2026-98226/index.md","name":"CVE-2026-98226","record":{"aliases":["BELL-CVE-2026-98226","DEBIAN-CVE-2026-98226","GHSA-7gvc-xwfg-q86p","UBUNTU-CVE-2026-98226"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_modify","denial_of_service"],"network_reachable":"unknown","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"An integer overflow in the Linux kernel swap subsystem can cause data loss and system instability when swap usage exceeds 4 TiB.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count\n\nSWAP_USAGE_OFFLIST_BIT is embedded in the si-\u003einuse_pages usage counter,\nand is meant to sit above any value that counter can reach.  However, it\nis defined from BITS_PER_TYPE(atomic_t), so it is bit 30.  On a system\nwith 4 KiB pages the flag collides with the usage count once that count\nreaches 4 TiB.\n\nswap_usage_in_pages() masks bit 30 out, so whenever the real count has\nthat bit set, every caller of it reads 4 TiB low:\n\n* /proc/swaps understates Used by 4 TiB.\n\n* A raw count of exactly 2^30 masks to zero, so try_to_unuse() takes its\n  \"if (!swap_usage_in_pages(si)) goto success;\" early exit and swapoff\n  tears the device down while pages are still swapped out. Nothing in\n  the rest of swapoff aborts the teardown, so those pages are lost.\n\nIndependently of swapoff, the collision also corrupts the counter and the\nplist.  On a device in normal use, a free that leaves bit 30 set in the\ncount makes swap_usage_sub() see the flag where there is only count, and\ncall add_to_avail_list().  It clears the bit with\nfetch_and(~SWAP_USAGE_OFFLIST_BIT), leaving the stored count 4 TiB below\nthe real one, and calls plist_add() on a device that is already listed,\ntripping the WARN_ON(!plist_node_empty(node)) in plist_add() and linking\nthe node a second time.\n\nChange the definition of SWAP_USAGE_OFFLIST_BIT to be based on\natomic_long_t instead.  Note that the usage counter field itself is of\nthis same type, so it is still a valid bit.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count","id":"CVE-2026-98226","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"memstick: ms_block: destroy io_queue workqueue on removal","id":"CVE-2026-98227"},"packages":[],"prev":{"headline":"mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem","id":"CVE-2026-98225"},"products":["Linux"],"published":"2026-10-06","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"An integer overflow in the Linux kernel swap subsystem can cause data loss and system instability when swap usage exceeds 4 TiB.","url":"https://insights.sbomify.com/CVE-2026-98226/"}