CVE-2026-64130 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and its fix. They should review the official advisory to determine the affected scope and severity. The vulnerability could potentially expose uninitialized tags, and defenders should verify the affected scope and severity with the official advisory.

Technical summary

The Linux kernel vulnerability, CVE-2026-64130, relates to the initialization of tags for the huge zero folio when using init_on_free. The __GFP_ZEROTAGS flag is used in conjunction with __GFP_ZERO and __GFP_SKIP_KASAN. However, when allocating with __GFP_ZEROTAG set, post_alloc_hook() skips clearing page content and tag memory. This issue affects the huge zero folio, which is mapped through a PMD marked as special, and can expose uninitialized tags. The fix decouples __GFP_ZEROTAGS from __GFP_ZERO and passes a flag to tag_clear_highpages() to clear page content.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel patch to decouple __GFP_ZEROTAGS from __GFP_ZERO
• Verify that the Linux kernel version used is not vulnerable
• Monitor for any potential issues related to memory tagging
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-19T16:17:54.723Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the official advisory. The fix decouples __GFP_ZEROTAGS from __GFP_ZERO and passes a flag to tag_clear_highpages() to clear page content. Linux kernel developers and maintainers should review the official advisory for more information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.