CVE-2026-72027 (GCVE-0-2026-72027)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
mm/compaction: handle free_pages_prepare() properly in compaction_free()
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/compaction: handle free_pages_prepare() properly in compaction_free() free_pages_prepare() can fail but compaction_free() does not handle the failure case. Failed pages should not be added back to cc->freepages for future use, since they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 733aea0b3a7bba0451dfc19322665de13a5b7af4 , < de8577db09039d4950239b01446ab5ead9028ab4 (git)
Affected: 733aea0b3a7bba0451dfc19322665de13a5b7af4 , < 018d7ad26cb8bdfe9842f2ca68a42b0bfdcc82fe (git)
Affected: 733aea0b3a7bba0451dfc19322665de13a5b7af4 , < 23afc3786acf359c135093893fb43a436768c832 (git)
Affected: 733aea0b3a7bba0451dfc19322665de13a5b7af4 , < 7da7d599b8a83271c464adfd5ef160202b470570 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/compaction.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "de8577db09039d4950239b01446ab5ead9028ab4",
              "status": "affected",
              "version": "733aea0b3a7bba0451dfc19322665de13a5b7af4",
              "versionType": "git"
            },
            {
              "lessThan": "018d7ad26cb8bdfe9842f2ca68a42b0bfdcc82fe",
              "status": "affected",
              "version": "733aea0b3a7bba0451dfc19322665de13a5b7af4",
              "versionType": "git"
            },
            {
              "lessThan": "23afc3786acf359c135093893fb43a436768c832",
              "status": "affected",
              "version": "733aea0b3a7bba0451dfc19322665de13a5b7af4",
              "versionType": "git"
            },
            {
              "lessThan": "7da7d599b8a83271c464adfd5ef160202b470570",
              "status": "affected",
              "version": "733aea0b3a7bba0451dfc19322665de13a5b7af4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/compaction.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/compaction: handle free_pages_prepare() properly in compaction_free()\n\nfree_pages_prepare() can fail but compaction_free() does not handle the\nfailure case.  Failed pages should not be added back to cc-\u003efreepages for\nfuture use, since they can be either PageHWPoison or free_page_is_bad()\nand might cause data corruption."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in mm/compaction.c compaction_free(), reached only via local kernel memory-management paths (__alloc_pages_slowpath/try_to_compact_pages, kcompactd, or root sysctl), not from network packet handlers or physical device insertion.\nAC:L - An unprivileged attacker can reliably drive compaction (THP/high-order mmap, memory pressure) and concurrently force migrate_pages failures and races so compaction_free() runs on pages where free_pages_prepare() rejects them; both sides are attacker-influenceable.\nPR:L - No special capability is required: ordinary local processes trigger direct compaction through normal allocators and transparent hugepage mappings, and user namespaces do not block these memory syscalls or kcompactd-driven compaction on the host.\nUI:N - Exploitation requires only the attacker\u0027s own memory-allocation and churn activity; no separate victim must mount filesystems, open files, or perform other interactive steps beyond routine process execution.\nS:U - Recycling PageHWPoison or free_page_is_bad() pages corrupts host kernel page-allocator/compaction state and process memory within the same OS security authority, not a VM-guest-to-host or IOMMU boundary crossing.\nC:H - Reusing pages that failed free_pages_prepare() can expose stale kernel or cross-process contents and enables allocator/page aliasing primitives; under the overestimate rule, this memory-corruption class supports high confidentiality impact.\nI:H - The fix explicitly warns these pages may cause data corruption when returned to cc-\u003efreepages; compaction_alloc() later hands them to migrate_pages as destinations, allowing corrupted/compound state to be written into live mappings.\nA:H - Reallocating HWPoison or allocator-marked bad pages during compaction can trigger kernel faults, bad-page detection, oopses, or panics when the poisoned folio is touched, satisfying high availability impact under the kernel crash guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:33.783Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/de8577db09039d4950239b01446ab5ead9028ab4"
        },
        {
          "url": "https://git.kernel.org/stable/c/018d7ad26cb8bdfe9842f2ca68a42b0bfdcc82fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/23afc3786acf359c135093893fb43a436768c832"
        },
        {
          "url": "https://git.kernel.org/stable/c/7da7d599b8a83271c464adfd5ef160202b470570"
        }
      ],
      "title": "mm/compaction: handle free_pages_prepare() properly in compaction_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72027",
    "datePublished": "2026-08-15T05:51:51.219Z",
    "dateReserved": "2026-08-09T03:40:39.901Z",
    "dateUpdated": "2026-08-17T05:39:33.783Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72027",
      "date": "2026-09-22",
      "epss": "0.00175",
      "percentile": "0.07321"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "mm/compaction.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "de8577db09039d4950239b01446ab5ead9028ab4",
                    "status": "affected",
                    "version": "733aea0b3a7bba0451dfc19322665de13a5b7af4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "018d7ad26cb8bdfe9842f2ca68a42b0bfdcc82fe",
                    "status": "affected",
                    "version": "733aea0b3a7bba0451dfc19322665de13a5b7af4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "23afc3786acf359c135093893fb43a436768c832",
                    "status": "affected",
                    "version": "733aea0b3a7bba0451dfc19322665de13a5b7af4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7da7d599b8a83271c464adfd5ef160202b470570",
                    "status": "affected",
                    "version": "733aea0b3a7bba0451dfc19322665de13a5b7af4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "mm/compaction.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/compaction: handle free_pages_prepare() properly in compaction_free()\n\nfree_pages_prepare() can fail but compaction_free() does not handle the\nfailure case.  Failed pages should not be added back to cc-\u003efreepages for\nfuture use, since they can be either PageHWPoison or free_page_is_bad()\nand might cause data corruption."
          }
        ],
        "id": "CVE-2026-72027",
        "lastModified": "2026-08-17T06:18:00.417",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:01.843",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/018d7ad26cb8bdfe9842f2ca68a42b0bfdcc82fe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/23afc3786acf359c135093893fb43a436768c832"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7da7d599b8a83271c464adfd5ef160202b470570"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/de8577db09039d4950239b01446ab5ead9028ab4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T17:47:53+00:00",
      "cve": "CVE-2026-72027",
      "id": "CVE-2026-72027",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/compaction: handle free_pages_prepare() properly in compaction_free()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72027.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:11:14Z",
      "cve": "CVE-2026-72027",
      "id": "CVE-2026-72027",
      "initial_release_date": "2026-08-27T00:24:22Z",
      "product_status:known_affected": "17",
      "product_status:known_not_affected": "345",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72027",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72027.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.