High 7.8Published May 8, 2026

CVE-2026-43303mm/page_alloc: clear page->private in free_pages_prepare()

Updated under an hour ago (Oct 27, 2026, 6:23 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private values. This causes a use-after-free in the swap subsystem. The swap code uses page->private to track swap count continuations, assuming freshly allocated pages have page->private == 0. When stale values are present, swap_count_continued() incorrectly assumes the continuation list is valid and iterates over uninitialized page->lru containing LIST_POISON values, causing a crash: KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] RIP: 0010:__do_sys_swapoff+0x1151/0x1860 Fix this by clearing page->private in free_pages_prepare(), ensuring all freed pages have clean state regardless of previous use.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-457
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3b8000ae185cb068adbda5f966a3835053c85fd4 before e7790ab165713b79b1617ce659742ceb3a859d05; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before 3edb8ebbf79b9016040e8f3421d723ae3d542b32; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before f9719e32a67b4b00b3c9b133e8b5ffa72a26b67b; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before 23b82b7a26182ad840ae67d390d7ec9771e8c00f; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before d757c793853ec5483eb41ec2942c300b8fa720fb; from 3b8000ae185cb068adbda5f966a3835053c85fd4 before ac1ea219590c09572ed5992dc233bbf7bb70fef9	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.18.1 before 6.18.16; from 6.19 before 6.19.6; 5.18; 5.18; 5.18; 5.18; 5.18; 5.18	NVD

References

References

https://git.kernel.org/stable/c/e7790ab165713b79b1617ce659742ceb3a859d05
https://git.kernel.org/stable/c/3edb8ebbf79b9016040e8f3421d723ae3d542b32
https://git.kernel.org/stable/c/f9719e32a67b4b00b3c9b133e8b5ffa72a26b67b
https://git.kernel.org/stable/c/23b82b7a26182ad840ae67d390d7ec9771e8c00f	patch
https://git.kernel.org/stable/c/d757c793853ec5483eb41ec2942c300b8fa720fb	patch
https://git.kernel.org/stable/c/ac1ea219590c09572ed5992dc233bbf7bb70fef9	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.