CVE-2026-64368 - Vulnerability Details

- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/slab: do not limit zeroing to orig_size when only red zoning is enabled

When init (zeroing) on allocation is requested, for kmalloc() we
generally have to zero the full object size even if a smaller size is
requested, in order to provide krealloc()'s __GFP_ZERO guarantees.

But if we track the requested size, krealloc() uses that information to
do the right thing, so we can zero only the requested size. With red
zoning also enabled, any extra size became part of the red zone, so it
must not be zeroed and thus we must zero only the requested size.

However the current check is imprecise, and will trigger also when only
SLAB_RED_ZONE is enabled without SLAB_STORE_USER (which enables tracking
the requested size). This means enabling red zoning alone can compromise
krealloc()'s __GFP_ZERO contract.

Fix this by using slub_debug_orig_size() instead, which is the exact
check for whether the requested size is tracked. We don't need to care
if red zoning is also enabled or not. Also update and expand the
comment accordingly.

Published: 2026-07-25

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the slab allocation logic of the Linux kernel. When an allocation request includes the __GFP_ZERO flag, the kernel is required to zero the entire object size. If only SLAB_RED_ZONE is enabled and SLAB_STORE_USER is disabled, the current check mistakenly stops zeroing after the requested size and leaves the red‑zone portion uncleared. This means the integrity of the __GFP_ZERO contract is violated, potentially exposing stale kernel memory to subsequent uses.

Affected Systems

Linux kernels compiled with SLAB_RED_ZONE enabled and SLAB_STORE_USER disabled are impacted. Any build that lacks the upstream patch that replaces the imprecise check with slub_debug_orig_size() is vulnerable. Version information is not specified, so the exact range of affected kernel releases is unknown.

Risk and Exploitability

The CVSS score of 8.1 classifies the vulnerability as high severity. The EPSS score is less than 1%, indicating a low likelihood of current exploitation. It is not listed in the CISA KEV catalog. Exploitation requires a kernel configuration that matches the vulnerable state and local control over the allocator; under typical use the risk of active attack remains low.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9ce67395f5a0cdec6ce152d26bfda13b98b25c01`	affected	< 6256899c3a34674bba6076884aedbba49fc695e4
`9ce67395f5a0cdec6ce152d26bfda13b98b25c01`	affected	< 7e706d50fa119eead6376bf0ef973e8d73a96030
`9ce67395f5a0cdec6ce152d26bfda13b98b25c01`	affected	< 2382971aaaef5bf85a651234c64906f59580b8be
`9ce67395f5a0cdec6ce152d26bfda13b98b25c01`	affected	< 0d18ccef142f04433dfb2a0c120cf223d2b8a42c
`9ce67395f5a0cdec6ce152d26bfda13b98b25c01`	affected	< 648927ceb84021a25a0fbd5673740956f318d534

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9ce67395f5a0cdec6ce152d26bfda13b98b25c01,6256899c3a34674bba6076884aedbba49fc695e4)`	affected	code_commit	—
`[9ce67395f5a0cdec6ce152d26bfda13b98b25c01,7e706d50fa119eead6376bf0ef973e8d73a96030)`	affected	code_commit	—
`[9ce67395f5a0cdec6ce152d26bfda13b98b25c01,2382971aaaef5bf85a651234c64906f59580b8be)`	affected	code_commit	—
`[9ce67395f5a0cdec6ce152d26bfda13b98b25c01,0d18ccef142f04433dfb2a0c120cf223d2b8a42)`	affected	code_commit	—
`[9ce67395f5a0cdec6ce152d26bfda13b98b25c01,648927ceb84021a25a0fbd5673740956f318d534)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	semver	—
`[0,6.2)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the system to a Linux kernel release that contains the slub_debug_orig_size() fix.
If a kernel update cannot be performed immediately, rebuild the kernel with SLAB_RED_ZONE disabled or enable SLAB_STORE_USER so that size tracking is correctly performed.
Verify kernel configuration and rebuild any custom kernels or modules to avoid the vulnerable combination of SLAB_RED_ZONE without SLAB_STORE_USER.

Generated by OpenCVE AI on October 23, 2026 at 00:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00417.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/0d18ccef142f04433dfb2a0c120cf223d2b8a42c
https://git.kernel.org/stable/c/2382971aaaef5bf85a651234c64906f59580b8be
https://git.kernel.org/stable/c/6256899c3a34674bba6076884aedbba49fc695e4
https://git.kernel.org/stable/c/648927ceb84021a25a0fbd5673740956f318d534
https://git.kernel.org/stable/c/7e706d50fa119eead6376bf0ef973e8d73a96030
https://lore.kernel.org/linux-cve-announce/2026072522-CVE-2026-64368-014f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64368
https://www.cve.org/CVERecord?id=CVE-2026-64368

History

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 04 Sep 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Sun, 02 Aug 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200 CWE-206

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026072522-CVE-2026-64368-014f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64368 https://www.cve.org/CVERecord?id=CVE-2026-64368
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 06:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-206

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled When init (zeroing) on allocation is requested, for kmalloc() we generally have to zero the full object size even if a smaller size is requested, in order to provide krealloc()'s __GFP_ZERO guarantees. But if we track the requested size, krealloc() uses that information to do the right thing, so we can zero only the requested size. With red zoning also enabled, any extra size became part of the red zone, so it must not be zeroed and thus we must zero only the requested size. However the current check is imprecise, and will trigger also when only SLAB_RED_ZONE is enabled without SLAB_STORE_USER (which enables tracking the requested size). This means enabling red zoning alone can compromise krealloc()'s __GFP_ZERO contract. Fix this by using slub_debug_orig_size() instead, which is the exact check for whether the requested size is tracked. We don't need to care if red zoning is also enabled or not. Also update and expand the comment accordingly.
Title		mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0d18ccef142f04433dfb2a0c120cf223d2b8a42c https://git.kernel.org/stable/c/2382971aaaef5bf85a651234c64906f59580b8be https://git.kernel.org/stable/c/6256899c3a34674bba6076884aedbba49fc695e4 https://git.kernel.org/stable/c/648927ceb84021a25a0fbd5673740956f318d534 https://git.kernel.org/stable/c/7e706d50fa119eead6376bf0ef973e8d73a96030

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:21.831Z

Updated: 2026-10-19T20:38:24.997Z

Reserved: 2026-07-19T15:36:31.783Z

Link: CVE-2026-64368

Vulnrichment

Updated: 2026-10-16T15:39:32.373Z

NVD

Status : Modified

Published: 2026-07-25T10:17:19.613

Modified: 2026-10-19T21:17:33.260

Link: CVE-2026-64368

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64368 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T00:15:13Z

Weaknesses

CWE-665
Improper Initialization
CWE-824
Access of Uninitialized Pointer
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object