CVE-2026-64418

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm: shrinker: fix shrinker_info teardown race with expansion

expand_shrinker_info() iterates all visible memcgs under shrinker_mutex,

including memcgs that have not finished ->css_online() yet.

Once pn->shrinker_info has been published, teardown must stay serialized

with expand_shrinker_info() until that memcg is either fully online or no

longer visible to iteration. Today alloc_shrinker_info() breaks that rule

by dropping shrinker_mutex before freeing a partially initialized

shrinker_info array, which may cause the following race:

CPU0 CPU1

==== ====

css_create

--> list_add_tail_rcu(&css->sibling, &parent_css->children);

online_css

--> mem_cgroup_css_online

--> alloc_shrinker_info

--> alloc node0 info

rcu_assign_pointer(C->node0->shrinker_info, old0)

alloc node1 info -> FAIL -> goto err

mutex_unlock(sh

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References