mm/page_alloc: clear page->private in free_pages_prepare()
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private values. This causes a use-after-free in the swap subsystem. The swap code uses page->private to track swap count continuations, assuming freshly allocated pages have page->private == 0. When stale values are present, swap_count_continued() incorrectly assumes the continuation list is valid and iterates over uninitialized page->lru containing LIST_POISON values, causing a crash: KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] RIP: 0010:__do_sys_swapoff+0x1151/0x1860 Fix this by clearing page->private in free_pages_prepare(), ensuring all freed pages have clean state regardless of previous use.
CVE-2026-43303
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-43303
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"lessThan": "e7790ab165713b79b1617ce659742ceb3a859d05",
"versionType": "git"
},
{
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"lessThan": "3edb8ebbf79b9016040e8f3421d723ae3d542b32",
"versionType": "git"
},
{
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"lessThan": "f9719e32a67b4b00b3c9b133e8b5ffa72a26b67b",
"versionType": "git"
},
{
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"lessThan": "23b82b7a26182ad840ae67d390d7ec9771e8c00f",
"versionType": "git"
},
{
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"lessThan": "d757c793853ec5483eb41ec2942c300b8fa720fb",
"versionType": "git"
},
{
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"lessThan": "ac1ea219590c09572ed5992dc233bbf7bb70fef9",
"versionType": "git"
}
],
"programFiles": [
"mm/page_alloc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"mm/page_alloc.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-43303
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40055 · Revision 1
- Added to Heist Feed
- Publisher date