Improper Initialization in Linux kernel - CVE-2026-64368
Published: July 27, 2026
Vulnerability identifier: #VU139603
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64368
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper initialization in slab allocation handling in mm/slub.c when allocating kmalloc objects with zeroing enabled. A local user can trigger a memory allocation pattern that leaves part of the allocated object uninitialized to disclose sensitive information.
The issue occurs when requested-size tracking is not enabled while red zoning alone is enabled, which can break krealloc() __GFP_ZERO expectations.
Affected software
Linux kernel
How to mitigate CVE-2026-64368
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0d18ccef142f04433dfb2a0c120cf223d2b8a42c
- https://git.kernel.org/stable/c/2382971aaaef5bf85a651234c64906f59580b8be
- https://git.kernel.org/stable/c/6256899c3a34674bba6076884aedbba49fc695e4
- https://git.kernel.org/stable/c/648927ceb84021a25a0fbd5673740956f318d534
- https://git.kernel.org/stable/c/7e706d50fa119eead6376bf0ef973e8d73a96030