Executive brief
A vulnerability in the Linux kernel's memory management system could allow a local user to cause a system crash or potentially execute unauthorized actions. The issue stems from how the system handles memory pages when they are freed and reused by different parts of the operating system. This could lead to service instability or a complete system outage, impacting business operations and data availability.
Technical details
A use-after-free vulnerability exists in the Linux kernel's mm/page_alloc component. Several subsystems (including slub, shmem, and ttm) use the 'page->private' field but fail to clear it before freeing pages. When these pages are subsequently reallocated as high-order pages and split, tail pages retain stale 'page->private' values. The swap subsystem, assuming freshly allocated pages have a zeroed 'private' field, may incorrectly interpret these stale values as valid continuation list pointers, leading to an out-of-bounds memory access and kernel panic (e.g., during swapoff). The fix involves explicitly clearing 'page->private' in the 'free_pages_prepare()' function.
Affected products
- Linux Linux Kernel 5.18.1 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-08: advisory: Initial disclosure of CVE-2026-43303
- 2026-05-08: disclosed
- 2026-06-09: patched