CVE-2026-64368
8.1Linux · Kernel
A memory management flaw in the Linux kernel slab allocator improperly limits zeroing during allocation when red zoning is enabled, compromising krealloc memory guarantees.
Executive summary
A high severity memory management vulnerability in the Linux kernel slab allocator can lead to critical confidentiality, integrity, and availability impacts if successfully exploited.
Vulnerability
This is a memory initialization flaw within the mm/slab component, triggered via improper zeroing checks when red zoning is enabled, requiring unauthenticated remote attack vectors with high attack complexity.
Business impact
A successful exploit of this kernel vulnerability can result in full system compromise, leading to unauthorized data exposure, system crashes, and complete service disruption. The assigned CVSS score of 8.1 reflects the severe potential impact on confidentiality, integrity, and availability, despite the high attack complexity required to achieve exploitation.
Remediation
Immediate Action: Update the Linux kernel to version 6.6.145, 6.12.96, 6.18.39, 7.1.4, or later where the fix is incorporated.
Proactive Monitoring: Monitor kernel logs for unusual crash traces, memory corruption warnings, or unexpected reboots associated with slab allocation routines.
Compensating Controls: Ensure kernel hardening features and memory protection mechanisms are fully enabled across the operating system environment to impede potential exploitation chains.
Exploitation status
Public Exploit Available: No
Analyst recommendation
System administrators must treat this high severity advisory with urgency by applying the patched kernel versions immediately. Coordinating maintenance windows to deploy the updated Linux kernel packages is essential for mitigating underlying memory corruption risks.