Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: clear page->private in free_pages_prepare()
Several subsystems (slub, shmem, ttm, etc.) use page->private but don’t clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private values.
This causes a use-after-free in the swap subsystem. The swap code uses page->private to track swap count continuations, assuming freshly allocated pages have page->private == 0. When stale values are present, swap_count_continued() incorrectly assumes the continuation list is valid and iterates over uninitialized page->lru containing LIST_POISON values, causing a crash:
KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] RIP: 0010:__do_sys_swapoff+0x1151/0x1860
Fix this by clearing page->private in free_pages_prepare(), ensuring all freed pages have clean state regardless of previous use.
Details
- Affected product:
- AlmaLinux 9.2 ESU , TuxCare 9.6 ESU
- Affected packages:
- kernel @ 5.14.0 (+1 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 10 | Released |
37 kernels
|
| AlmaLinux 9 | Released |
107 kernels
|
| AlmaLinux 9.2 ESU | Released |
24 kernels
|
| AlmaLinux 9.6 ESU | Released |
10 kernels
|
| Amazon Linux 2023 | Planned | — |
| Debian 12 | Planned | — |
| Debian 13 | Released |
10 kernels
|
| Oracle Linux 9 | Released |
109 kernels
|
| RHEL 10 | Released |
37 kernels
|
| RHEL 9 | Released |
105 kernels
|
| Rocky Linux 10 | Released |
27 kernels
|
| Rocky Linux 9 | Released |
86 kernels
|