Linux SLUB: krealloc __GFP_ZERO guarantee broken when red zoning is enabled without user tracking

Impact

kmalloc with zeroing normally clears the full object so that krealloc()'s __GFP_ZERO contract holds. The check that narrows zeroing to the requested size was imprecise: it also fired when SLAB_RED_ZONE was set without SLAB_STORE_USER, the configuration in which the requested size is not tracked. In that configuration a later krealloc(__GFP_ZERO) can leave the grown region holding stale heap contents instead of zeroes, which is an information-disclosure hazard for whatever callers rely on that guarantee. The scope condition is what an operator needs here: this only bites on kernels booted with red zoning and no user tracking (slub_debug=Z). Stock distro and cloud kernels do not enable that, so most fleets are simply not affected. NVD's 8.1 with a network attack vector is not supported by anything in the description - there is no remote path described.

Who can reach it

No attacker-facing interface is described in the record. The precondition is the host's own boot configuration: red zoning enabled without SLAB_STORE_USER. On such a host, code paths relying on init-on-alloc or __GFP_ZERO through krealloc may receive uninitialized bytes. Local only, and absent on default configurations.

What to do

First check whether you are affected at all: if you do not boot with slub_debug red zoning, you are not, and there is no reason to schedule anything. Where red zoning is enabled - debug or triage kernels - take the stable update and reboot the node, since this is allocator code. Five stable commits are listed; the record names no fixed release version.

References

Related entries

• Linux kernel (virt/kvm): The dirty-ring reset path bounds-checks an offset with unchecked 64-bit arithmetic, so aCVE-2026-52969 · Linux kernel (virt/kvm)High
• Linux kernel (arch/x86/kvm/svm): VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated againstCVE-2026-43133 · Linux kernel (arch/x86/kvm/svm)High
• util-linux nsenter: --join-cgroup leaks a root-opened cgroup.procs fd into the target containerCVE-2026-78408 · util-linux nsenter (--join-cgroup descriptor leak across execve)High
• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh
• Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping failsCVE-2014-3601 · Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pagesHigh
• ABRT: symlink attack on predictable core-dump paths gives local users root on RHEL hostsCVE-2015-5287 · ABRT abrt-hook-ccpp (core dump helper on RHEL/CentOS)High