CVE-2026-98226: Linux kernel · mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in 12e9ac7bc5b254048f886bf421e3a15491106c1f : patch Linux kernel soon.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 12e9ac7bc5b254048f886bf421e3a15491106c1f, 7c0d0d6de46076b43a2acaf1026b6648f8434c39, 0a41a46859df0d2bd7ed127197aac7c7389c00ed
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to 12e9ac7bc5b254048f886bf421e3a15491106c1f, 7c0d0d6de46076b43a2acaf1026b6648f8434c39 or 0a41a46859df0d2bd7ed127197aac7c7389c00ed.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in the specified commits. Users should update to a Linux kernel version that includes these fixes to resolve the issue. No additional mitigation steps are indicated beyond applying the official patch.
Description
CVE-2026-98226 is a vulnerability in the Linux kernel's memory management swap subsystem. It involves a collision between the SWAP_USAGE_OFFLIST_BIT flag and the real usage count in the swap usage counter, causing underreporting of swap usage by 4 TiB. This can lead to premature teardown of swap devices during swapoff operations while pages are still swapped out, resulting in data loss. The flaw also causes corruption of the usage counter and internal data structures, potentially triggering kernel warnings and instability. The issue is fixed by redefining the SWAP_USAGE_OFFLIST_BIT based on atomic_long_t to avoid collision.