Duty Analyst: Joseph McCarthy

CVE-2026-43303

Published: 2026-05-08 14:16:38 | Last modified: 2026-05-15 13:27:39

HIGH CVSS 7.8
No EPSS data

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/page_alloc: clear page->private in free_pages_prepare()

Several subsystems (slub, shmem, ttm, etc.) use page->private but don't
clear it before freeing pages. When these pages are later allocated as
high-order pages and split via split_page(), tail pages retain stale
page->private values.

This causes a use-after-free in the swap subsystem. The swap code uses
page->private to track swap count continuations, assuming freshly
allocated pages have page->private == 0. When stale values are present,
swap_count_continued() incorrectly assumes the continuation list is valid
and iterates over uninitialized page->lru containing LIST_POISON values,
causing a crash:

KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107]
RIP: 0010:__do_sys_swapoff+0x1151/0x1860

Fix this by clearing page->private in free_pages_prepare(), ensuring all
freed pages have clean state regardless of previous use.

CVSS details

Severity
high
Score
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

This CVE is not currently listed in the EPSS dataset.

Show JSON
{
    "cve": {
        "id": "CVE-2026-43303",
        "cveTags": [],
        "metrics": {
            "cvssMetricV31": [
                {
                    "type": "Secondary",
                    "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                    "cvssData": {
                        "scope": "UNCHANGED",
                        "version": "3.1",
                        "baseScore": 7.8,
                        "attackVector": "LOCAL",
                        "baseSeverity": "HIGH",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "integrityImpact": "HIGH",
                        "userInteraction": "NONE",
                        "attackComplexity": "LOW",
                        "availabilityImpact": "HIGH",
                        "privilegesRequired": "LOW",
                        "confidentialityImpact": "HIGH"
                    },
                    "impactScore": 5.9,
                    "exploitabilityScore": 1.8
                }
            ]
        },
        "published": "2026-05-08T14:16:37.583",
        "references": [
            {
                "url": "https://git.kernel.org/stable/c/23b82b7a26182ad840ae67d390d7ec9771e8c00f",
                "tags": [
                    "Patch"
                ],
                "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
            },
            {
                "url": "https://git.kernel.org/stable/c/ac1ea219590c09572ed5992dc233bbf7bb70fef9",
                "tags": [
                    "Patch"
                ],
                "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
            },
            {
                "url": "https://git.kernel.org/stable/c/d757c793853ec5483eb41ec2942c300b8fa720fb",
                "tags": [
                    "Patch"
                ],
                "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
            }
        ],
        "vulnStatus": "Analyzed",
        "weaknesses": [
            {
                "type": "Primary",
                "source": "nvd@nist.gov",
                "description": [
                    {
                        "lang": "en",
                        "value": "CWE-416"
                    }
                ]
            }
        ],
        "descriptions": [
            {
                "lang": "en",
                "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: clear page->private in free_pages_prepare()\n\nSeveral subsystems (slub, shmem, ttm, etc.) use page->private but don't\nclear it before freeing pages.  When these pages are later allocated as\nhigh-order pages and split via split_page(), tail pages retain stale\npage->private values.\n\nThis causes a use-after-free in the swap subsystem.  The swap code uses\npage->private to track swap count continuations, assuming freshly\nallocated pages have page->private == 0.  When stale values are present,\nswap_count_continued() incorrectly assumes the continuation list is valid\nand iterates over uninitialized page->lru containing LIST_POISON values,\ncausing a crash:\n\n  KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107]\n  RIP: 0010:__do_sys_swapoff+0x1151/0x1860\n\nFix this by clearing page->private in free_pages_prepare(), ensuring all\nfreed pages have clean state regardless of previous use."
            }
        ],
        "lastModified": "2026-05-15T13:27:39.440",
        "configurations": [
            {
                "nodes": [
                    {
                        "negate": false,
                        "cpeMatch": [
                            {
                                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "B1BE1177-E500-439D-B3E5-0E63F54C1BE6",
                                "versionEndExcluding": "6.18.16",
                                "versionStartIncluding": "5.18.1"
                            },
                            {
                                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
                                "versionEndExcluding": "6.19.6",
                                "versionStartIncluding": "6.19"
                            },
                            {
                                "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "0384FA0A-DE99-48D7-84E3-46ED0C3B5E03"
                            },
                            {
                                "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc4:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "DA5F085D-52F3-4EE2-8353-455D1A6FE073"
                            },
                            {
                                "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc5:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "D6EE5B78-0D83-4715-893C-ABD69B49E7FC"
                            },
                            {
                                "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc6:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "EE723F14-047B-4FCF-B109-E0542EDFB063"
                            },
                            {
                                "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "2FCFCE58-5118-4D05-864E-C82CF20EABE5"
                            },
                            {
                                "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc9:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "9C3E5BC9-613C-4362-BF02-153A5BBFFB2F"
                            }
                        ],
                        "operator": "OR"
                    }
                ]
            }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
}