The Linux kernel vulnerability CVE-2026-64130 concerns the improper initialization of memory tags for huge zero folios when the init_on_free feature is enabled. Specifically, the __GFP_ZEROTAGS flag, which controls tag clearing, is currently coupled with __GFP_ZERO and __GFP_SKIP_KASAN flags. When allocating pages with __GFP_ZEROTAGS set, the post_alloc_hook skips clearing both page content and tag memory. For most pages, tags are initialized later when mapped to user space, but huge zero folios mapped through PMD entries marked as special do not undergo this initialization, leading to exposure of stale tag data. The fix decouples __GFP_ZEROTAGS from __GFP_ZERO and adjusts tag clearing logic to ensure proper initialization. The issue was reproduced in arm64 memory tagging extension self-tests and is classified under CWE-908 (Use of Uninitialized Resource).

The vulnerability does not affect confidentiality or integrity but can impact availability, as indicated by the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The exposure of stale memory tags could lead to unexpected behavior or system instability in affected configurations. There are no known exploits in the wild. The impact is limited to systems running the affected Linux kernel with init_on_free enabled and using huge zero folios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates that the vulnerability has been resolved in the Linux kernel source, but no explicit patch links or fixed versions are provided. Users should monitor official Linux kernel releases and apply updates when available. No additional mitigation steps are specified in the advisory.