The vulnerability (CVE-2026-64368) in the Linux kernel's slab allocator occurs because the zeroing of allocated memory objects was incorrectly limited to the original size when only red zoning was enabled, without SLAB_STORE_USER which tracks requested size. This imprecise check could cause krealloc()'s __GFP_ZERO contract to be compromised, potentially leading to uninitialized memory exposure. The fix involves using slub_debug_orig_size() to accurately determine if the requested size is tracked and zero only that size. This issue affects Linux kernel versions prior to 7.0.0-31.31 and related builds in the linux-hwe-edge package. The vulnerability is part of a broader set of kernel security fixes released by Ubuntu in September 2026.

The vulnerability could allow local attackers to bypass memory zeroing guarantees, potentially exposing uninitialized memory contents or causing memory corruption. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported. The flaw affects multiple kernel subsystems and architectures as part of a larger update addressing several security issues.

A patch is available and should be applied by updating to the fixed Linux kernel versions as specified in the Ubuntu advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigation steps are indicated beyond applying the official updates.