Skip to content
fr Sign in
7.8 High

CVE-2026-43303 In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in…

Description

In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private values. This causes a use-after-free in the swap subsystem. The swap code uses page->private to track swap count continuations, assuming freshly allocated pages have page->private == 0. When stale values are present, swap_count_continued() incorrectly assumes the continuation list is valid and iterates over uninitialized page->lru containing LIST_POISON values, causing a crash: KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] RIP: 0010:__do_sys_swapoff+0x1151/0x1860 Fix this by clearing page->private in free_pages_prepare(), ensuring all freed pages have clean state regardless of previous use.

Affected products and versions

Product Affected versions Fixed in
Linux 7.0 earliest → < 7.0 7.0
Linux 6.19 earliest → < 6.19.6 6.19.6
Linux 6.18 earliest → < 6.18.16 6.18.16
Linux 6.12 earliest → < 6.12.93 6.12.93
Linux 6.6 earliest → < 6.6.143 6.6.143
Linux 6.1 earliest → < 6.1.176 6.1.176
Linux 5.18 No fix stated
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.7 → latest No fix stated
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 3.1.7 → latest No fix stated
Show the 2 other branches
Product Affected versions Fixed in
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.7 → latest No fix stated
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Linux

The 18283 CVEs of Linux →
CVE-2026-99270 In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler() 8.1 High CVE-2026-99269 In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before… 7.8 High CVE-2026-99261 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for… Not rated CVE-2026-99260 In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags… Not rated
Track this CVE