CVE-2026-64419

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()

Reading the debugfs "count" file of a memcg-aware shrinker can sleep

inside an RCU read-side critical section:

BUG: sleeping function called from invalid context at kernel/cgroup/rstat.c:421

RCU nest depth: 1, expected: 0

css_rstat_flush

mem_cgroup_flush_stats

zswap_shrinker_count

shrinker_debugfs_count_show

shrinker_debugfs_count_show() invokes the ->count_objects() callback under

rcu_read_lock(). The zswap callback flushes memcg stats via

css_rstat_flush(), which may sleep, so it must not run under RCU.

The RCU lock is not needed here. mem_cgroup_iter() takes RCU internally

and returns a memcg holding a css reference (dropped on the next iteration

or by mem_cgroup_iter_break()), so the memcg stays alive without it. The

shrinker is kept alive by the open debugfs file: shrinker_free() removes

the debugfs entries via debugfs_remov

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References