Linux SLUB: krealloc __GFP_ZERO guarantee broken when red zoning is enabled without user tracking

Impact

kmalloc with zeroing normally clears the full object so that krealloc()'s __GFP_ZERO contract holds. The check that narrows zeroing to the requested size was imprecise: it also fired when SLAB_RED_ZONE was set without SLAB_STORE_USER, the configuration in which the requested size is not tracked. In that configuration a later krealloc(__GFP_ZERO) can leave the grown region holding stale heap contents instead of zeroes, which is an information-disclosure hazard for whatever callers rely on that guarantee. The scope condition is what an operator needs here: this only bites on kernels booted with red zoning and no user tracking (slub_debug=Z). Stock distro and cloud kernels do not enable that, so most fleets are simply not affected. NVD's 8.1 with a network attack vector is not supported by anything in the description - there is no remote path described.

Who can reach it

No attacker-facing interface is described in the record. The precondition is the host's own boot configuration: red zoning enabled without SLAB_STORE_USER. On such a host, code paths relying on init-on-alloc or __GFP_ZERO through krealloc may receive uninitialized bytes. Local only, and absent on default configurations.

What to do

First check whether you are affected at all: if you do not boot with slub_debug red zoning, you are not, and there is no reason to schedule anything. Where red zoning is enabled - debug or triage kernels - take the stable update and reboot the node, since this is allocator code. Five stable commits are listed; the record names no fixed release version.

References

Related entries

• Linux SUNRPC: unchecked percpu_counter_init leaves nfsd running on NULL per-cpu statsCVE-2026-89547 · Linux kernel SUNRPC (__svc_create per-pool percpu_counter init)High
• Linux NFSD: filecache shutdown race leaks nfsd_file objects and their stateCVE-2026-89667 · Linux kernel NFSD filecache (shrinker/GC/fsnotify vs per-net shutdown)High
• Linux kernel nfsd: use-after-free on the per-net file cache disposal queue during namespace teardownCVE-2026-89682 · Linux kernel nfsd (file cache delayed disposal, nfsd_fcache_disposal)High
• Linux kernel qla2xxx: use-after-free when a late response interrupt reaches an already-freed request queueCVE-2026-89848 · Linux kernel qla2xxx (qpair teardown, response IRQ vs request queue free)High
• Linux kernel qla2xxx: virtual port used after vport_slock is dropped, allowing a use-after-freeCVE-2026-89861 · Linux kernel qla2xxx (qla24xx_report_id_acquisition vport reference)High
• Linux iommu/vt-d: context entry zeroed while Present, letting hardware fetch a torn entryCVE-2026-90243 · Linux kernel iommu/vt-d (copied context entry teardown ordering)High