The vulnerability (CVE-2026-64130) in the Linux kernel concerns the improper initialization of memory tags for huge zero folios when allocated with the __GFP_ZEROTAGS flag alongside init_on_free. Normally, pages are zeroed on free to optimize allocation, and tags are cleared when mapped to user space. However, huge zero folios mapped through a special PMD do not trigger tag initialization, leaving stale tags exposed. The fix involves separating the clearing of tags from page content zeroing and adjusting the tag_clear_highpages() function semantics to ensure proper tag clearing regardless of page content zeroing. This issue was reproduced and tested on ARM64 with memory tagging extension self-tests.

The vulnerability could lead to exposure of stale memory tags in huge zero folios, which may affect memory tagging integrity on ARM64 systems using init_on_free. This could potentially undermine the security guarantees provided by memory tagging extensions by exposing residual tag data. However, no known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to address this issue by properly clearing tags on huge zero folios. Users should update to the fixed kernel version once available. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.