CVE-2026-64368

A flaw was found in the Linux kernel's memory management subsystem. This issue occurs when the kernel's memory allocator attempts to zero out newly allocated memory, but an incorrect check prevents the full memory region from being cleared under specific configurations. This can lead to memory not being fully zeroed as intended, potentially allowing a local attacker to access sensitive information from previously used memory regions.

This vulnerability is rated as Moderate because exploitation requires local access and relies on specific non-default SLUB debug settings, limiting the risk in standard enterprise deployments. In typical Red Hat Enterprise Linux installations, memory allocator red zoning is not enabled by default, preventing unprivileged users from encountering the condition under normal operating parameters. Consequently, the flaw primarily poses a threat of uninitialized memory exposure or unexpected kernel state in specialized debugging configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.