CVE-2026-64416

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host

lookup_swap_cgroup_id() passes swap_cgroup_ctrl[type].map to

__swap_cgroup_id_lookup() without checking that the type was ever

registered via swap_cgroup_swapon(). On a swapless host every ctrl->map

is NULL, so __swap_cgroup_id_lookup() dereferences NULL + a scaled

swp_offset().

Since commit bea67dcc5eea ("mm: attempt to batch free swap entries for

zap_pte_range()"), zap_pte_range() -> swap_pte_batch() calls

lookup_swap_cgroup_id() on any non-present, non-none PTE that decodes as a

real swap entry, without first validating it against swap_info[]. A

single PTE corrupted into a type-0 swap entry takes the host down at

process exit.

We hit this in production on a swapless 6.12.58 host: ~1s of

"get_swap_device: Bad swap file entry 3f800204222bb" (do_swap_page() being

correctly defensive about the same entry) followed by

BUG: unable to handle

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References