Skip to main content

Linux Kernel CVE-2026-72027

| EUVDEUVD-2026-58985 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-2q3f-m66c-mqfj
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Requires low-privilege local access and hardware-poisoned pages to be present (PageHWPoison from ECC errors), making reliable exploitation hardware-condition-dependent, warranting AC:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:41 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mm/compaction: handle free_pages_prepare() properly in compaction_free()

free_pages_prepare() can fail but compaction_free() does not handle the failure case. Failed pages should not be added back to cc->freepages for future use, since they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.

AnalysisAI

Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.

Technical ContextAI

The vulnerability is rooted in mm/compaction.c, the Linux kernel subsystem responsible for defragmenting physical memory pages to satisfy large contiguous allocation requests. During compaction, compaction_free() serves as a callback to return pages to the compaction freelist (cc->freepages). It calls free_pages_prepare() to prepare pages for safe reuse, but does not inspect the return value. free_pages_prepare() deliberately returns failure for pages marked PageHWPoison (hardware-detected memory errors, typically surfaced via Machine Check Exceptions on ECC systems) or flagged by free_page_is_bad(). When these checks are bypassed due to unchecked return values, corrupted or poisoned pages re-enter circulation. The root cause maps to improper error handling (analogous to CWE-391: Unchecked Return Value) compounded by use of memory that should be quarantined, creating a use-after-poison condition. The CWE field is unassigned in NVD data. Affected commit ancestry begins at 733aea0b3a7bba0451dfc19322665de13a5b7af4 across multiple stable kernel series.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.12.97, 6.18.40, 7.1.5, or 7.2-rc3 or later. Upstream fix commits are available at https://git.kernel.org/stable/c/018d7ad26cb8bdfe9842f2ca68a42b0bfdcc82fe and the three sibling commits for other stable branches. For systems where immediate kernel upgrade is not feasible, a compensating control is to disable or reduce proactive memory compaction by setting sysctl vm.compaction_proactiveness=0 (persist in /etc/sysctl.d/) or running echo 0 > /proc/sys/vm/compaction_proactiveness at runtime - this reduces the frequency of compaction_free() invocations and narrows the exposure window. Note that disabling proactive compaction may increase memory fragmentation and degrade performance for workloads requiring large contiguous memory allocations (e.g., HugePage-dependent applications). This workaround does not eliminate the flaw, as compaction can still be triggered reactively under memory pressure. See https://nvd.nist.gov/vuln/detail/CVE-2026-72027 for the NVD advisory and the kernel stable tree for patch details.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72027 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy