CVE-2026-72027 mm/compaction: handle free_pages_prepare() properly in compaction_free()
A flaw in Linux kernel memory compaction allows corrupted pages to be reused, potentially causing data corruption or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72027?
CVE-2026-72027 is a high-severity memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/compaction: handle free_pages_prepare() properly in compaction_free()
free_pages_prepare() can fail but compaction_free() does not handle the failure case. Failed pages should not be added back to cc->freepages for future use, since they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.
Which versions are affected by CVE-2026-72027?
How do I fix CVE-2026-72027?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72027 being exploited?
There is no known exploitation of CVE-2026-72027 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72027, DEBIAN-CVE-2026-72027, GHSA-2q3f-m66c-mqfj, UBUNTU-CVE-2026-72027.