mm PagePrivate UAF

Vulnerability analysis

The root cause is that multiple subsystems (slub, shmem, ttm) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private values. The swap subsystem assumes freshly allocated pages have page->private == 0 and uses this field to track swap count continuations. When stale values are present, swap_count_continued() incorrectly treats the stale data as a valid continuation list and iterates over uninitialized page->lru containing LIST_POISON values, causing a use-after-free crash. Because this is a heap use-after-free involving a dereferenced stale pointer, the primitive can also enable limited information leak (C:Low) and memory corruption (I:Low) in addition to the denial of service. The fix clears page->private in free_pages_prepare() to ensure all freed pages have clean state. This is a local vulnerability requiring low privileges to trigger swap activity, with high availability impact due to kernel crashes.