Medium 5.5Published Jul 25, 2026

CVE-2026-64417mm: shrinker: fix NULL pointer dereference in debugfs

Updated under an hour ago (Oct 26, 2026, 11:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinker_debugfs_add() creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both count_objects() and scan_objects(), which is not guaranteed. For example, the xen-backend shrinker sets count_objects() but leaves scan_objects() NULL, so writing to its scan file calls through a NULL function pointer and panics the kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. Call Trace: <TASK> shrinker_debugfs_scan_write+0x12e/0x270 full_proxy_write+0x5f/0x90 vfs_write+0xde/0x420 ? filp_flush+0x75/0x90 ? filp_close+0x1d/0x30 ? do_dup2+0xb8/0x120 ksys_write+0x68/0xf0 ? filp_flush+0x75/0x90 do_syscall_64+0xb3/0x5b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The count path has the same issue in principle if a shrinker omits count_objects(). To fix it, only create "count" and "scan" debugfs files when the corresponding callbacks are present.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 before ebb45c2648b1f60715fd283700f651e05e431231; from bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 before 09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9; from bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 before 36f8534f461222291a74156ab91f3ba9f09b6f93; from bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 before 006467ab932698612398f853344a7405164541f4; from bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 before b9beed2322f3538b0d2d53307062da4102b8d8d8; from bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 before e30453c61e185e914fde83c650e268067b140218	CNA record
linux linux_kernel linux:linux_kernel	from 6.0 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 7.2; 7.2	NVD

References

References

https://git.kernel.org/stable/c/ebb45c2648b1f60715fd283700f651e05e431231	patch
https://git.kernel.org/stable/c/09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9	patch
https://git.kernel.org/stable/c/36f8534f461222291a74156ab91f3ba9f09b6f93	patch
https://git.kernel.org/stable/c/006467ab932698612398f853344a7405164541f4	patch
https://git.kernel.org/stable/c/b9beed2322f3538b0d2d53307062da4102b8d8d8	patch
https://git.kernel.org/stable/c/e30453c61e185e914fde83c650e268067b140218	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.