CVE-2026-64417

mm: shrinker: fix NULL pointer dereference in debugfs

State: Published
Severity: Not scored
Published: Jul 25, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mm: shrinker: fix NULL pointer dereference in debugfs

shrinker_debugfs_add() creates both "count" and "scan" debugfs files unconditionally.

That assumes every shrinker implements both count_objects() and scan_objects(), which is not guaranteed. For example, the xen-backend shrinker sets count_objects() but leaves scan_objects() NULL, so writing to its scan file calls through a NULL function pointer and panics the kernel:

BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. Call Trace: <TASK> shrinker_debugfs_scan_write+0x12e/0x270 full_proxy_write+0x5f/0x90 vfs_write+0xde/0x420 ? filp_flush+0x75/0x90 ? filp_close+0x1d/0x30 ? do_dup2+0xb8/0x120 ksys_write+0x68/0xf0 ? filp_flush+0x75/0x90 do_syscall_64+0xb3/0x5b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

The count path has the same issue in principle if a shrinker omits count_objects().

To fix it, only create "count" and "scan" debugfs files when the corresponding callbacks are present.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before ebb45c2648b1f60715fd283700f651e05e431231Affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before 09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9Affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before 36f8534f461222291a74156ab91f3ba9f09b6f93Affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before 006467ab932698612398f853344a7405164541f4Affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before b9beed2322f3538b0d2d53307062da4102b8d8d8Affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before e30453c61e185e914fde83c650e268067b140218Affected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before ebb45c2648b1f60715fd283700f651e05e431231Affected
bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before 09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9Affected
bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before 36f8534f461222291a74156ab91f3ba9f09b6f93Affected
bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before 006467ab932698612398f853344a7405164541f4Affected
bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before b9beed2322f3538b0d2d53307062da4102b8d8d8Affected
bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 to before e30453c61e185e914fde83c650e268067b140218Affected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.