CVE-2026-72027

Received Received - Intake

Linux Kernel Memory Corruption in Compaction Free

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/compaction: handle free_pages_prepare() properly in compaction_free() free_pages_prepare() can fail but compaction_free() does not handle the failure case. Failed pages should not be added back to cc->freepages for future use, since they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72027

EUVD

EUVD-2026-58985

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the compaction_free() function fails to properly handle errors from free_pages_prepare(). When free_pages_prepare() fails, the pages should not be reused but the code incorrectly adds them back to the free page list. This can lead to corrupted pages being used, potentially causing data corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory compaction mechanism and does not have a direct network detection method. Detection requires checking kernel logs for compaction-related errors or corruption events. Monitor dmesg or system logs for messages related to PageHWPoison or free_page_is_bad failures during memory operations.

Impact Analysis

If exploited, this could cause system instability, crashes, or data corruption. Systems relying on memory compaction for performance or reliability may experience unexpected failures or silent data corruption.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to memory management in the Linux kernel. No evidence suggests it impacts data privacy or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Update your system to a kernel version where the fix for mm/compaction is included. If immediate patching is not possible, avoid triggering memory compaction operations until the fix is applied to prevent potential data corruption.

Hi! I’m here to help you understand CVE-2026-72027. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70