The Linux kernel memory allocator fails to clear memory tag bits for a special "huge zero folio" page when both the init_on_free option and the __GFP_ZEROTAGS flag are enabled. Because the tag bits are skipped during the zeroing process, stale tag values that were set earlier in kernel operation can be exposed when the page is later mapped into user space. This flaw does not provide an attacker with privilege escalation or code execution, but it leaks internal tag information that undermines the confidentiality guarantees of the Memory Tagging Extension (MTE). The weakness is a CWE‑908 (Improper Initialization). Based on the description, it is inferred that exploitation of this flaw would require local kernel privileges.

The vulnerability affects Linux kernel builds compiled for the arm64 architecture that support Memory Tagging Extension (MTE). Kernels that are compiled with the default init_on_free enabled and that use the __GFP_ZEROTAGS flag are impacted. The fix is contained in commit c/2f2aec5120b93a8f8b52dc50cdc60dbb8aec72f6 and subsequent releases, so any kernel not including this commit is vulnerable.

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of < 1 % and the absence from CISA's KEV catalog suggest a low likelihood of active exploitation. Based on the description, it is inferred that an attacker would need local kernel privileges to invoke the specific allocation path that uses init_on_free together with __GFP_ZEROTAGS, a capability normally restricted to privileged code. No remote attack vector is implied, and the impact is strictly information disclosure rather than denial of service or privilege escalation.