PT-2026-64638 · Linux · Linux
CVE-2026-64417
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
mm: shrinker: fix NULL pointer dereference in debugfs
shrinker debugfs add() creates both "count" and "scan" debugfs files
unconditionally.
That assumes every shrinker implements both count objects() and
scan objects(), which is not guaranteed. For example, the xen-backend
shrinker sets count objects() but leaves scan objects() NULL, so writing
to its scan file calls through a NULL function pointer and panics the
kernel:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
Call Trace:
shrinker debugfs scan write+0x12e/0x270
full proxy write+0x5f/0x90
vfs write+0xde/0x420
? filp flush+0x75/0x90
? filp close+0x1d/0x30
? do dup2+0xb8/0x120
ksys write+0x68/0xf0
? filp flush+0x75/0x90
do syscall 64+0xb3/0x5b0
entry SYSCALL 64 after hwframe+0x76/0x7e
The count path has the same issue in principle if a shrinker omits
count objects().
To fix it, only create "count" and "scan" debugfs files when the
corresponding callbacks are present.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux