PT-2026-64639 · Linux · Linux

CVE-2026-64418

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
mm: shrinker: fix shrinker info teardown race with expansion
expand shrinker info() iterates all visible memcgs under shrinker mutex, including memcgs that have not finished ->css online() yet.
Once pn->shrinker info has been published, teardown must stay serialized with expand shrinker info() until that memcg is either fully online or no longer visible to iteration. Today alloc shrinker info() breaks that rule by dropping shrinker mutex before freeing a partially initialized shrinker info array, which may cause the following race:
CPU0 CPU1 ==== ====
css create --> list add tail rcu(&css->sibling, &parent css->children); online css --> mem cgroup css online --> alloc shrinker info --> alloc node0 info rcu assign pointer(C->node0->shrinker info, old0) alloc node1 info -> FAIL -> goto err mutex unlock(shrinker mutex)
        shrinker alloc()
        --> shrinker memcg alloc
          --> mutex lock(shrinker mutex)
            expand shrinker info
            --> mem cgroup iter see the memcg
              expand one shrinker info
              --> old0 = C->node0->shrinker info
                memcpy(new->unit, old0->unit, ...);

    free shrinker info
    --> kvfree(old0);

                /* double free !! */
                kvfree rcu(old0, rcu);
The same problem exists later in mem cgroup css online(). If alloc shrinker info() succeeds but a subsequent objcg allocation fails, the free objcg -> free shrinker info() unwind path tears down the already published pn->shrinker info arrays without shrinker mutex. The expand one shrinker info() can race with that teardown in the same way, leading to use-after-free or double-free of the old shrinker info.
Fix this by serializing shrinker info teardown with shrinker mutex, and by keeping alloc shrinker info() error cleanup inside the locked section.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-64418

Affected Products

Linux