{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm\/page_alloc: clear page-\\u003eprivate in free_pages_prepare()\\n\\nSeveral subsystems (slub, shmem, ttm, etc.) use page-\\u003eprivate but don’t\\nclear it before freeing pages. When these pages are later allocated as\\nhigh-order pages and split via split_page(), tail pages retain stale\\npage-\\u003eprivate values.\\n\\nThis causes a use-after-free in the swap subsystem. The swap code uses\\npage-\\u003eprivate to track swap count continuations, assuming freshly\\nallocated pages have page-\\u003eprivate == 0. When stale values are present,\\nswap_count_continued() incorrectly assumes the continuation list is valid\\nand iterates over uninitialized page-\\u003elru containing LIST_POISON values,\\ncausing a crash:\\n\\n KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107]\\n RIP: 0010:__do_sys_swapoff+0x1151\/0x1860\\n\\nFix this by clearing page-\\u003eprivate in free_pages_prepare(), ensuring all\\nfreed pages have clean state regardless of previous use.”,”published”:”2026-05-08T13:11:23.561Z”,”modified”:”2026-05-11T06:33:01.702Z”,”type”:”cve”,”title”:”mm\/page_alloc: clear page-\\u003eprivate in free_pages_prepare()”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/23b82b7a26182ad840ae67d390d7ec9771e8c00f\\nhttps:\/\/git.kernel.org\/stable\/c\/d757c793853ec5483eb41ec2942c300b8fa720fb\\nhttps:\/\/git.kernel.org\/stable\/c\/ac1ea219590c09572ed5992dc233bbf7bb70fef9″,”id”:”CVE-2026-43303″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 3b8000ae185cb068adbda5f966a3835053c85fd4\\nLinux Linux 3b8000ae185cb068adbda5f966a3835053c85fd4\\nLinux Linux 3b8000ae185cb068adbda5f966a3835053c85fd4\\nLinux Linux 5.18″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”3b8000ae185cb068adbda5f966a3835053c85fd4″,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm\/page_alloc: clear page-\\u003eprivate in free_pages_prepare()\\n\\nSeveral subsystems (slub, shmem, ttm, etc.) use page-\\u003eprivate but don’t\\nclear it before…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-52941","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n