Executive brief
A vulnerability was identified in the Linux kernel's memory management system that could lead to data corruption or unexpected behavior. When the system allocates memory, it may fail to properly clear (zero out) the entire memory block if certain debugging features are enabled. This could result in subsequent operations using 'dirty' memory that contains remnants of previous data, potentially impacting system stability or security.
Technical details
A vulnerability in mm/slab.c (and mm/slab.h) occurs when SLAB_RED_ZONE is enabled without SLAB_STORE_USER. In this configuration, the kernel's kmalloc implementation may fail to zero the full object size, instead only zeroing the requested 'orig_size'. This violates the __GFP_ZERO contract required by krealloc(), as the extra space between the requested size and the actual object size remains uninitialized. An attacker or a flawed kernel module could potentially exploit this to read uninitialized memory or cause kernel instability when memory is reallocated. The fix replaces the imprecise check with slub_debug_orig_size() to ensure the full object is zeroed unless the requested size is explicitly tracked.
Affected products
- Linux Linux Kernel 6.2 to 7.1.4
Timeline
- 2026-06-10: other: Patch authored by Vlastimil Babka
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0d18ccef142f04433dfb2a0c120cf223d2b8a42c
- https://git.kernel.org/stable/c/2382971aaaef5bf85a651234c64906f59580b8be
- https://git.kernel.org/stable/c/6256899c3a34674bba6076884aedbba49fc695e4
- https://git.kernel.org/stable/c/648927ceb84021a25a0fbd5673740956f318d534
- https://git.kernel.org/stable/c/7e706d50fa119eead6376bf0ef973e8d73a96030