CVE-2026-64417 mm: shrinker: fix NULL pointer dereference in debugfs
A local attacker can crash the Linux kernel by writing to debugfs files for shrinkers missing specific callbacks, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64417?
CVE-2026-64417 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm: shrinker: fix NULL pointer dereference in debugfs
shrinker_debugfs_add() creates both "count" and "scan" debugfs files unconditionally.
That assumes every shrinker implements both count_objects() and scan_objects(), which is not guaranteed. For example, the xen-backend shrinker sets count_objects() but leaves scan_objects() NULL, so writing to its scan file calls through a NULL function pointer and panics the kernel:
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. Call Trace: <TASK> shrinker_debugfs_scan_write+0x12e/0x270 full_proxy_write+0x5f/0x90 vfs_write+0xde/0x420 ? filp_flush+0x75/0x90 ? filp_close+0x1d/0x30 ? do_dup2+0xb8/0x120 ksys_write+0x68/0xf0 ? filp_flush+0x75/0x90 do_syscall_64+0xb3/0x5b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The count path has the same issue in principle if a shrinker omits count_objects().
To fix it, only create "count" and "scan" debugfs files when the corresponding callbacks are present.
Weakness: CWE-476
Which versions are affected by CVE-2026-64417?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64417?
Apply the vendor's patch.
Is CVE-2026-64417 being exploited?
There is no known exploitation of CVE-2026-64417 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64417, DEBIAN-CVE-2026-64417, GHSA-fmww-fwc4-2q32, ROOT-OS-UBUNTU-2204-CVE-2026-64417, UBUNTU-CVE-2026-64417.