CVE-2026-43303mm/page_alloc: clear page->private in free_pages_prepare()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private values. This causes a use-after-free in the swap subsystem. The swap code uses page->private to track swap count continuations, assuming freshly allocated pages have page->private == 0. When stale values are present, swap_count_continued() incorrectly assumes the continuation list is valid and iterates over uninitialized page->lru containing LIST_POISON values, causing a crash: KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] RIP: 0010:__do_sys_swapoff+0x1151/0x1860 Fix this by clearing page->private in free_pages_prepare(), ensuring all freed pages have clean state regardless of previous use.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 3b8000ae185cb068adbda5f966a3835053c85fd4 before e7790ab165713b79b1617ce659742ceb3a859d05; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before 3edb8ebbf79b9016040e8f3421d723ae3d542b32; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before f9719e32a67b4b00b3c9b133e8b5ffa72a26b67b; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before 23b82b7a26182ad840ae67d390d7ec9771e8c00f; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before d757c793853ec5483eb41ec2942c300b8fa720fb; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before ac1ea219590c09572ed5992dc233bbf7bb70fef9 | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.18.1 before 6.18.16; from 6.19 before 6.19.6; 5.18; 5.18; 5.18; 5.18; 5.18; 5.18 | NVD |
References
- https://git.kernel.org/stable/c/e7790ab165713b79b1617ce659742ceb3a859d05
- https://git.kernel.org/stable/c/3edb8ebbf79b9016040e8f3421d723ae3d542b32
- https://git.kernel.org/stable/c/f9719e32a67b4b00b3c9b133e8b5ffa72a26b67b
- https://git.kernel.org/stable/c/23b82b7a26182ad840ae67d390d7ec9771e8c00fpatch
- https://git.kernel.org/stable/c/d757c793853ec5483eb41ec2942c300b8fa720fbpatch
- https://git.kernel.org/stable/c/ac1ea219590c09572ed5992dc233bbf7bb70fef9patch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.