CVE-2026-64130: In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: fix initialization of tags of the hu
Summary
A bug in the Linux kernel's memory management caused the huge zero folio (a special large block of pre-allocated zero memory) to expose uncleared security tags (metadata used by ARM64's memory tagging extension) when init_on_free was enabled. The issue happened because the kernel skipped tag initialization for this special memory page, violating the documented guarantee that allocation tags should be zeroed when memory is first mapped to user space.
Solution / Mitigation
Fix it by decoupling __GFP_ZEROTAGS from __GFP_ZERO, passing to tag_clear_highpages() whether we want to also clear page content. Invert the meaning of the tag_clear_highpages() return value to have clearer semantics.
Vulnerability Details
EPSS: 0.0%
July 19, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-64130
First tracked: July 19, 2026 at 02:09 PM
Classified by LLM (prompt v3) · confidence: 95%