{"id":"CVE-2026-64130","state":"PUBLISHED","title":"mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free\n\n__GFP_ZEROTAGS semantics are currently a bit weird, but effectively this\nflag is only ever set alongside __GFP_ZERO and __GFP_SKIP_KASAN.\n\nIf we run with init_on_free, we will zero out pages during\n__free_pages_prepare(), to skip zeroing on the allocation path.\n\nHowever, when allocating with __GFP_ZEROTAG set, post_alloc_hook() will\nconsequently not only skip clearing page content, but also skip clearing\ntag memory.\n\nNot clearing tags through __GFP_ZEROTAGS is irrelevant for most pages that\nwill get mapped to user space through set_pte_at() later: set_pte_at() and\nfriends will detect that the tags have not been initialized yet\n(PG_mte_tagged not set), and initialize them.\n\nHowever, for the huge zero folio, which will be mapped through a PMD\nmarked as special, this initialization will not be performed, ending up\nexposing whatever tags were still set for the pages.\n\nThe docs (Documentation/arch/arm64/memory-tagging-extension.rst) state\nthat allocation tags are set to 0 when a page is first mapped to user\nspace.  That no longer holds with the huge zero folio when init_on_free is\nenabled.\n\nFix it by decoupling __GFP_ZEROTAGS from __GFP_ZERO, passing to\ntag_clear_highpages() whether we want to also clear page content.\n\nInvert the meaning of the tag_clear_highpages() return value to have\nclearer semantics.\n\nReproduced with the huge zero folio by modifying the check_buffer_fill\narm64/mte selftest to use a 2 MiB area, after making sure that pages have\na non-0 tag set when freeing (note that, during boot, we will not actually\ninitialize tags, but only set KASAN_TAG_KERNEL in the page flags).\n\n\t$ ./check_buffer_fill\n\t1..20\n\t...\n\tnot ok 17 Check initial tags with private mapping, sync error mode and mmap memory\n\tnot ok 18 Check initial tags with private mapping, sync error mode and mmap/mprotect memory\n\t...\n\nThis code needs more cleanups; we'll tackle that next, like\ndecoupling __GFP_ZEROTAGS from __GFP_SKIP_KASAN.\n\n[akpm@linux-foundation.org: s/__GPF_ZERO/__GFP_ZERO/, per David]","publishedAt":"2026-07-19T15:40:26.108Z","updatedAt":"2026-07-19T15:40:26.108Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"adfb6609c6809e107ded9a1cd46f519c882e64ea","status":"affected","lessThan":"738d18f1da3513d17b6f7bf30146cc4ac2480ffd","versionType":"git"},{"version":"adfb6609c6809e107ded9a1cd46f519c882e64ea","status":"affected","lessThan":"2f2aec5120b93a8f8b52dc50cdc60dbb8aec72f6","versionType":"git"},{"version":"adfb6609c6809e107ded9a1cd46f519c882e64ea","status":"affected","lessThan":"6a288a4ddb4a994490505ab5f41c445f8e6b6467","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/include/asm/page.h","arch/arm64/mm/fault.c","include/linux/gfp_types.h","include/linux/highmem.h","mm/page_alloc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/include/asm/page.h","arch/arm64/mm/fault.c","include/linux/gfp_types.h","include/linux/highmem.h","mm/page_alloc.c"]}],"references":["https://git.kernel.org/stable/c/738d18f1da3513d17b6f7bf30146cc4ac2480ffd","https://git.kernel.org/stable/c/2f2aec5120b93a8f8b52dc50cdc60dbb8aec72f6","https://git.kernel.org/stable/c/6a288a4ddb4a994490505ab5f41c445f8e6b6467"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64130.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64130","state":"PUBLISHED","datePublished":"2026-07-19T15:40:26.108Z","dateUpdated":"2026-07-19T15:40:26.108Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.036Z"},"containers":{"cna":{"title":"mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free\n\n__GFP_ZEROTAGS semantics are currently a bit weird, but effectively this\nflag is only ever set alongside __GFP_ZERO and __GFP_SKIP_KASAN.\n\nIf we run with init_on_free, we will zero out pages during\n__free_pages_prepare(), to skip zeroing on the allocation path.\n\nHowever, when allocating with __GFP_ZEROTAG set, post_alloc_hook() will\nconsequently not only skip clearing page content, but also skip clearing\ntag memory.\n\nNot clearing tags through __GFP_ZEROTAGS is irrelevant for most pages that\nwill get mapped to user space through set_pte_at() later: set_pte_at() and\nfriends will detect that the tags have not been initialized yet\n(PG_mte_tagged not set), and initialize them.\n\nHowever, for the huge zero folio, which will be mapped through a PMD\nmarked as special, this initialization will not be performed, ending up\nexposing whatever tags were still set for the pages.\n\nThe docs (Documentation/arch/arm64/memory-tagging-extension.rst) state\nthat allocation tags are set to 0 when a page is first mapped to user\nspace.  That no longer holds with the huge zero folio when init_on_free is\nenabled.\n\nFix it by decoupling __GFP_ZEROTAGS from __GFP_ZERO, passing to\ntag_clear_highpages() whether we want to also clear page content.\n\nInvert the meaning of the tag_clear_highpages() return value to have\nclearer semantics.\n\nReproduced with the huge zero folio by modifying the check_buffer_fill\narm64/mte selftest to use a 2 MiB area, after making sure that pages have\na non-0 tag set when freeing (note that, during boot, we will not actually\ninitialize tags, but only set KASAN_TAG_KERNEL in the page flags).\n\n\t$ ./check_buffer_fill\n\t1..20\n\t...\n\tnot ok 17 Check initial tags with private mapping, sync error mode and mmap memory\n\tnot ok 18 Check initial tags with private mapping, sync error mode and mmap/mprotect memory\n\t...\n\nThis code needs more cleanups; we'll tackle that next, like\ndecoupling __GFP_ZEROTAGS from __GFP_SKIP_KASAN.\n\n[akpm@linux-foundation.org: s/__GPF_ZERO/__GFP_ZERO/, per David]"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"adfb6609c6809e107ded9a1cd46f519c882e64ea","status":"affected","lessThan":"738d18f1da3513d17b6f7bf30146cc4ac2480ffd","versionType":"git"},{"version":"adfb6609c6809e107ded9a1cd46f519c882e64ea","status":"affected","lessThan":"2f2aec5120b93a8f8b52dc50cdc60dbb8aec72f6","versionType":"git"},{"version":"adfb6609c6809e107ded9a1cd46f519c882e64ea","status":"affected","lessThan":"6a288a4ddb4a994490505ab5f41c445f8e6b6467","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/include/asm/page.h","arch/arm64/mm/fault.c","include/linux/gfp_types.h","include/linux/highmem.h","mm/page_alloc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/include/asm/page.h","arch/arm64/mm/fault.c","include/linux/gfp_types.h","include/linux/highmem.h","mm/page_alloc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/738d18f1da3513d17b6f7bf30146cc4ac2480ffd"},{"url":"https://git.kernel.org/stable/c/2f2aec5120b93a8f8b52dc50cdc60dbb8aec72f6"},{"url":"https://git.kernel.org/stable/c/6a288a4ddb4a994490505ab5f41c445f8e6b6467"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-07-19T15:40:26.108Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}