CVE-2026-64368

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the slab memory allocator where the zeroing process during allocation is incorrectly limited when only red zoning is enabled. When kmalloc() is used with a request for initialization (zeroing), the full object size must typically be zeroed to maintain the GFP ZERO guarantees for krealloc(). However, an imprecise check causes the system to limit zeroing to the original size even when SLAB RED ZONE is enabled without SLAB STORE USER (the feature that enables tracking of the requested size). This failure to zero the full object size can compromise the GFP ZERO contract of krealloc(). The issue is resolved by implementing slub debug orig size() to accurately verify if the requested size is being tracked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.