CVE-2026-64417

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm: shrinker: fix NULL pointer dereference in debugfs

shrinker_debugfs_add() creates both "count" and "scan" debugfs files

unconditionally.

That assumes every shrinker implements both count_objects() and

scan_objects(), which is not guaranteed. For example, the xen-backend

shrinker sets count_objects() but leaves scan_objects() NULL, so writing

to its scan file calls through a NULL function pointer and panics the

kernel:

BUG: kernel NULL pointer dereference, address: 0000000000000000

RIP: 0010:0x0

Code: Unable to access opcode bytes at 0xffffffffffffffd6.

Call Trace:

<TASK>

shrinker_debugfs_scan_write+0x12e/0x270

full_proxy_write+0x5f/0x90

vfs_write+0xde/0x420

? filp_flush+0x75/0x90

? filp_close+0x1d/0x30

? do_dup2+0xb8/0x120

ksys_write+0x68/0xf0

? filp_flush+0x75/0x90

do_syscall_64+0xb3/0x5b0

entry_SYSCALL_64_after_hwframe+0x76/0x7e

The count path has the same issue in principle if a shrinker omits

co

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References