{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-64130 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64130 is a medium-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64130 and fix it if it is affected.\n\nWhat it is: CVE-2026-64130 is a medium-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64130 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64130/ (Markdown: https://insights.sbomify.com/CVE-2026-64130/index.md)","id":"CVE-2026-64130","markdown":"https://insights.sbomify.com/CVE-2026-64130/index.md","name":"CVE-2026-64130","record":{"aliases":["BELL-CVE-2026-64130","DEBIAN-CVE-2026-64130","GHSA-jjh5-mvrv-5xmg","UBUNTU-CVE-2026-64130"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"An attacker can read uninitialized memory tags from the huge zero folio in the Linux kernel when init_on_free is enabled, violating memory tagging guarantees.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-908","name":"Use of Uninitialized Resource"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free\n\n__GFP_ZEROTAGS semantics are currently a bit weird, but effectively this\nflag is only ever set alongside __GFP_ZERO and __GFP_SKIP_KASAN.\n\nIf we run with init_on_free, we will zero out pages during\n__free_pages_prepare(), to skip zeroing on the allocation path.\n\nHowever, when allocating with __GFP_ZEROTAG set, post_alloc_hook() will\nconsequently not only skip clearing page content, but also skip clearing\ntag memory.\n\nNot clearing tags through __GFP_ZEROTAGS is irrelevant for most pages that\nwill get mapped to user space through set_pte_at() later: set_pte_at() and\nfriends will detect that the tags have not been initialized yet\n(PG_mte_tagged not set), and initialize them.\n\nHowever, for the huge zero folio, which will be mapped through a PMD\nmarked as special, this initialization will not be performed, ending up\nexposing whatever tags were still set for the pages.\n\nThe docs (Documentation/arch/arm64/memory-tagging-extension.rst) state\nthat allocation tags are set to 0 when a page is first mapped to user\nspace.  That no longer holds with the huge zero folio when init_on_free is\nenabled.\n\nFix it by decoupling __GFP_ZEROTAGS from __GFP_ZERO, passing to\ntag_clear_highpages() whether we want to also clear page content.\n\nInvert the meaning of the tag_clear_highpages() return value to have\nclearer semantics.\n\nReproduced with the huge zero folio by modifying the check_buffer_fill\narm64/mte selftest to use a 2 MiB area, after making sure that pages have\na non-0 tag set when freeing (note that, during boot, we will not actually\ninitialize tags, but only set KASAN_TAG_KERNEL in the page flags).\n\n\t$ ./check_buffer_fill\n\t1..20\n\t...\n\tnot ok 17 Check initial tags with private mapping, sync error mode and mmap memory\n\tnot ok 18 Check initial tags with private mapping, sync error mode and mmap/mprotect memory\n\t...\n\nThis code needs more cleanups; we'll tackle that next, like\ndecoupling __GFP_ZEROTAGS from __GFP_SKIP_KASAN.\n\n[akpm@linux-foundation.org: s/__GPF_ZERO/__GFP_ZERO/, per David]","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free","id":"CVE-2026-64130","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"information_disclosure","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"mm/memory: fix spurious warning when unmapping device-private/exclusive pages","id":"CVE-2026-64131"},"packages":[],"prev":{"headline":"mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page","id":"CVE-2026-64129"},"products":["Linux"],"published":"2026-07-19","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-07-19","vendors":["Linux"]},"summary":"An attacker can read uninitialized memory tags from the huge zero folio in the Linux kernel when init_on_free is enabled, violating memory tagging guarantees.","url":"https://insights.sbomify.com/CVE-2026-64130/"}