PT-2026-64638 · Linux · Linux
CVE-2026-64417
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
mm: shrinker: fix NULL pointer dereference in debugfs
shrinker debugfs add() creates both "count" and "scan" debugfs files
unconditionally.
That assumes every shrinker implements both count objects() and
scan objects(), which is not guaranteed. For example, the xen-backend
shrinker sets count objects() but leaves scan objects() NULL, so writing
to its scan file calls through a NULL function pointer and panics the
kernel:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
Call Trace:
shrinker debugfs scan write+0x12e/0x270
full proxy write+0x5f/0x90
vfs write+0xde/0x420
? filp flush+0x75/0x90
? filp close+0x1d/0x30
? do dup2+0xb8/0x120
ksys write+0x68/0xf0
? filp flush+0x75/0x90
do syscall 64+0xb3/0x5b0
entry SYSCALL 64 after hwframe+0x76/0x7e
The count path has the same issue in principle if a shrinker omits
count objects().
To fix it, only create "count" and "scan" debugfs files when the
corresponding callbacks are present.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux