CVE-2026-64130

A flaw was found in the Linux kernel's memory management subsystem. When the init_on_free feature is enabled, the system may fail to properly initialize memory tags for 'huge zero folios' (large blocks of memory filled with zeros) before they are mapped to user space. This oversight can lead to the exposure of previously set memory tags, potentially allowing an attacker to gain sensitive information from the system's memory.

This vulnerability is rated as Moderate impact because exploitation is constrained to local unprivileged users and requires specific hardware supporting ARM64 Memory Tagging Extension (MTE) alongside page zeroing hardening features. The issue allows uninitialized memory tags on shared zero pages to be exposed rather than granting direct arbitrary read or write access across process boundaries. Additionally, the code managing huge zero folio allocation tags was introduced in upstream kernel versions and is not present in supported Red Hat Enterprise Linux releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.