Executive brief
The Linux kernel's memory compaction system manages physical memory organization to improve performance. A flaw in the compaction_free() function fails to properly detect when page preparation fails, potentially allowing corrupted or poisoned memory pages to be reused, which could lead to data corruption or system instability during memory operations.
Technical details
The vulnerability is an improper error handling flaw in the mm/compaction.c module. The compaction_free() function calls free_pages_prepare() to validate and prepare pages for reuse, but does not check the return value for failure. When free_pages_prepare() returns false—indicating the page is hardware-poisoned or failed validation—the corrupted page is still added to the free list via cc->freepages for future allocation. This can occur on hardware with memory errors or when free_page_is_bad() detects page corruption. The fix adds a logical AND to combine the folio_put_testzero() check with free_pages_prepare() return value, ensuring pages are only recycled if both conditions succeed. No authentication or special privileges are required; the issue can manifest during normal memory compaction operations triggered by system memory pressure.
Affected products
- Linux Linux Kernel multiple versions (see stable branch tags)
Timeline
- 2026-08-15: disclosed: CVE-2026-72027 published
- 2026-06-22: patched: Fix committed by Zi Yan upstream