Executive brief
A vulnerability in the Linux kernel's memory management subsystem could allow a local user to crash the system. The issue occurs when the system attempts to access certain debug files (debugfs) associated with memory 'shrinkers' that do not have the expected functions implemented. This results in a kernel panic, leading to a complete system denial of service.
Technical details
A NULL pointer dereference exists in mm/shrinker_debug.c within the Linux kernel. The function shrinker_debugfs_add() unconditionally creates 'count' and 'scan' debugfs files for every shrinker, assuming that all shrinkers implement both count_objects() and scan_objects() callbacks. However, some shrinkers (such as xen-backend) may omit these callbacks. When a local user with access to debugfs attempts to write to these files, the kernel attempts to execute a NULL function pointer, resulting in a kernel panic. The fix ensures these debugfs files are only created if the corresponding callbacks are defined.
Affected products
- Linux Linux Kernel 6.0 to 6.1.178, 6.6.x, 6.9.x
Timeline
- 2026-06-17: disclosed: Initial patch submitted by Qi Zheng
- 2026-07-18: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-07-25: advisory: CVE-2026-64417 published
References
- https://git.kernel.org/stable/c/006467ab932698612398f853344a7405164541f4
- https://git.kernel.org/stable/c/09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9
- https://git.kernel.org/stable/c/36f8534f461222291a74156ab91f3ba9f09b6f93
- https://git.kernel.org/stable/c/b9beed2322f3538b0d2d53307062da4102b8d8d8
- https://git.kernel.org/stable/c/e30453c61e185e914fde83c650e268067b140218
- https://git.kernel.org/stable/c/ebb45c2648b1f60715fd283700f651e05e431231