CVE-2026-64368

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/slab: do not limit zeroing to orig_size when only red zoning is enabled<br /> <br /> When init (zeroing) on allocation is requested, for kmalloc() we<br /> generally have to zero the full object size even if a smaller size is<br /> requested, in order to provide krealloc()&amp;#39;s __GFP_ZERO guarantees.<br /> <br /> But if we track the requested size, krealloc() uses that information to<br /> do the right thing, so we can zero only the requested size. With red<br /> zoning also enabled, any extra size became part of the red zone, so it<br /> must not be zeroed and thus we must zero only the requested size.<br /> <br /> However the current check is imprecise, and will trigger also when only<br /> SLAB_RED_ZONE is enabled without SLAB_STORE_USER (which enables tracking<br /> the requested size). This means enabling red zoning alone can compromise<br /> krealloc()&amp;#39;s __GFP_ZERO contract.<br /> <br /> Fix this by using slub_debug_orig_size() instead, which is the exact<br /> check for whether the requested size is tracked. We don&amp;#39;t need to care<br /> if red zoning is also enabled or not. Also update and expand the<br /> comment accordingly.