CVE-2026-64417
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinker_debugfs_add() creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both count_objects() and scan_objects(), which is not guaranteed. For example, the xen-backend shrinker sets count_objects() but leaves scan_objects() NULL, so writing to its scan file calls through a NULL function pointer and panics the kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. Call Trace: <TASK> shrinker_debugfs_scan_write+0x12e/0x270 full_proxy_write+0x5f/0x90 vfs_write+0xde/0x420 ? filp_flush+0x75/0x90 ? filp_close+0x1d/0x30 ? do_dup2+0xb8/0x120 ksys_write+0x68/0xf0 ? filp_flush+0x75/0x90 do_syscall_64+0xb3/0x5b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The count path has the same issue in principle if a shrinker omits count_objects(). To fix it, only create "count" and "scan" debugfs files when the corresponding callbacks are present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64417
EUVD
EUVD-2026-48961

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the Linux kernel's memory management shrinker debugfs interface. It occurs when shrinker_debugfs_add() creates debugfs files for both 'count' and 'scan' operations unconditionally, assuming all shrinkers implement both count_objects() and scan_objects() callbacks. If a shrinker omits either callback, writing to the corresponding debugfs file triggers a kernel panic due to a NULL function pointer call.

Detection Guidance

This vulnerability can be detected by checking for NULL pointer dereferences in kernel logs related to shrinker debugfs operations. Look for kernel panic messages or oops reports mentioning shrinker_debugfs_scan_write or similar functions. Check if any shrinker modules have NULL scan_objects() or count_objects() callbacks while debugfs files exist.

Impact Analysis

This vulnerability can cause system crashes (kernel panics) when interacting with certain shrinker debugfs files. If a vulnerable system has a shrinker missing either count_objects() or scan_objects(), attempting to write to its debugfs 'scan' or 'count' file will crash the kernel, leading to data loss or denial of service.

Mitigation Strategies

Apply the Linux kernel patch that ensures debugfs files are only created when corresponding shrinker callbacks exist. Update to a kernel version containing the fix. Monitor kernel logs for shrinker-related crashes and disable affected shrinker modules if necessary until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64417. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart