CVE-2026-64130

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the memory management system where the initialization of tags for the huge zero folio is not correctly handled when init on free is enabled. When allocating with the GFP ZEROTAGS flag, the post alloc hook() function skips clearing both page content and tag memory. While most pages mapped to user space via set pte at() eventually initialize these tags, the huge zero folio is mapped through a special PMD (Page Middle Directory), which bypasses this initialization. This results in the exposure of residual tags from previously freed pages, contradicting the expected behavior where allocation tags are set to 0 upon the first mapping to user space.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.