High 7.8Published Aug 15, 2026

CVE-2026-72027mm/compaction: handle free_pages_prepare() properly in compaction_free()

Updated under an hour ago (2026-10-19 11:10 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mm/compaction: handle free_pages_prepare() properly in compaction_free() free_pages_prepare() can fail but compaction_free() does not handle the failure case. Failed pages should not be added back to cc->freepages for future use, since they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 733aea0b3a7bba0451dfc19322665de13a5b7af4 before de8577db09039d4950239b01446ab5ead9028ab4; 733aea0b3a7bba0451dfc19322665de13a5b7af4 builds before 018d7ad26cb8bdfe9842f2ca68a42b0bfdcc82fe; 733aea0b3a7bba0451dfc19322665de13a5b7af4 builds before 23afc3786acf359c135093893fb43a436768c832; 733aea0b3a7bba0451dfc19322665de13a5b7af4 builds before 7da7d599b8a83271c464adfd5ef160202b470570	CNA record

References

https://git.kernel.org/stable/c/de8577db09039d4950239b01446ab5ead9028ab4
https://git.kernel.org/stable/c/018d7ad26cb8bdfe9842f2ca68a42b0bfdcc82fe
https://git.kernel.org/stable/c/23afc3786acf359c135093893fb43a436768c832
https://git.kernel.org/stable/c/7da7d599b8a83271c464adfd5ef160202b470570

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.