CVE-2026-64418 - Vulnerability Details

- mm: shrinker: fix shrinker_info teardown race with expansion

Description

In the Linux kernel, the following vulnerability has been resolved:

mm: shrinker: fix shrinker_info teardown race with expansion

expand_shrinker_info() iterates all visible memcgs under shrinker_mutex,
including memcgs that have not finished ->css_online() yet.

Once pn->shrinker_info has been published, teardown must stay serialized
with expand_shrinker_info() until that memcg is either fully online or no
longer visible to iteration. Today alloc_shrinker_info() breaks that rule
by dropping shrinker_mutex before freeing a partially initialized
shrinker_info array, which may cause the following race:

CPU0 CPU1
==== ====

css_create
--> list_add_tail_rcu(&css->sibling, &parent_css->children);
online_css
--> mem_cgroup_css_online
--> alloc_shrinker_info
--> alloc node0 info
rcu_assign_pointer(C->node0->shrinker_info, old0)
alloc node1 info -> FAIL -> goto err
mutex_unlock(shrinker_mutex)

shrinker_alloc()
--> shrinker_memcg_alloc
--> mutex_lock(shrinker_mutex)
expand_shrinker_info
--> mem_cgroup_iter see the memcg
expand_one_shrinker_info
--> old0 = C->node0->shrinker_info
memcpy(new->unit, old0->unit, ...);

free_shrinker_info
--> kvfree(old0);

/* double free !! */
kvfree_rcu(old0, rcu);

The same problem exists later in mem_cgroup_css_online(). If
alloc_shrinker_info() succeeds but a subsequent objcg allocation fails,
the free_objcg -> free_shrinker_info() unwind path tears down the already
published pn->shrinker_info arrays without shrinker_mutex. The
expand_one_shrinker_info() can race with that teardown in the same way,
leading to use-after-free or double-free of the old shrinker_info.

Fix this by serializing shrinker_info teardown with shrinker_mutex, and by
keeping alloc_shrinker_info() error cleanup inside the locked section.

Published: 2026-07-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a race condition in the Linux kernel’s memory cgroup shrinker code, corresponding to CWE-364. When shrinker_info is torn down while still being expanded, a double free or use‑after‑free can occur, corrupting kernel memory. This flaw can cause kernel crashes or, if further exploitation is possible, compromise kernel integrity.

Affected Systems

All Linux kernel versions are potentially affected, as the race exists in core mm/shrinker code, and the CVE does not specify a fixed version range. No specific affected-version range is provided.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation. The CVSS score of 7.8 indicates high severity. The most likely attack vector is local, occurring during memory cgroup creation or teardown, and would require a process with sufficient rights to manipulate cgroups. Successful exploitation could lead to kernel instability or privilege escalation, but no confirmed exploits or specific exploitation methods have been reported to date.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`307bececcd1205bcb67a3c0d53a69db237ccc9d4`	affected	< b9a280a9a454ed514636351d53fe2a233dc5054b
`307bececcd1205bcb67a3c0d53a69db237ccc9d4`	affected	< 6465ff3ce65131c774a312d450abe10f4b9f3875
`307bececcd1205bcb67a3c0d53a69db237ccc9d4`	affected	< 284c267f013e45d8c89d9fb9373105dc8e6c0947
`307bececcd1205bcb67a3c0d53a69db237ccc9d4`	affected	< 65476d31d8056e859c48580f82295ce159196ffe

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[307bececcd1205bcb67a3c0d53a69db237ccc9d4,b9a280a9a454ed514636351d53fe2a233dc5054b)`	affected	code_commit	—
`[307bececcd1205bcb67a3c0d53a69db237ccc9d4,6465ff3ce65131c774a312d450abe10f4b9f3875)`	affected	code_commit	—
`[307bececcd1205bcb67a3c0d53a69db237ccc9d4,284c267f013e45d8c89d9fb9373105dc8e6c0947)`	affected	code_commit	—
`[307bececcd1205bcb67a3c0d53a69db237ccc9d4,65476d31d8056e859c48580f82295ce159196ffe)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.7`	affected	generic	—
`[0,6.7)`	unaffected	generic	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the re‑entrant mutex protection for shrinker_info teardown
If a patch is not immediately available, restrict or disable user‑initiated memory‑cgroup creation to prevent the race condition
Enable kernel hardening features such as CONFIG_RCU_USER_LOOP, CONFIG_DEBUG_KERNEL, or other memory protection options
Monitor system logs for kernel panics or segmentation faults that may indicate exploitation attempts

Generated by OpenCVE AI on August 3, 2026 at 18:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00125.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947
https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875
https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe
https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b
https://lore.kernel.org/linux-cve-announce/2026072533-CVE-2026-64418-4aed@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64418
https://www.cve.org/CVERecord?id=CVE-2026-64418

History

Tue, 28 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026072533-CVE-2026-64418-4aed@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64418 https://www.cve.org/CVERecord?id=CVE-2026-64418
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race with expansion expand_shrinker_info() iterates all visible memcgs under shrinker_mutex, including memcgs that have not finished ->css_online() yet. Once pn->shrinker_info has been published, teardown must stay serialized with expand_shrinker_info() until that memcg is either fully online or no longer visible to iteration. Today alloc_shrinker_info() breaks that rule by dropping shrinker_mutex before freeing a partially initialized shrinker_info array, which may cause the following race: CPU0 CPU1 ==== ==== css_create --> list_add_tail_rcu(&css->sibling, &parent_css->children); online_css --> mem_cgroup_css_online --> alloc_shrinker_info --> alloc node0 info rcu_assign_pointer(C->node0->shrinker_info, old0) alloc node1 info -> FAIL -> goto err mutex_unlock(shrinker_mutex) shrinker_alloc() --> shrinker_memcg_alloc --> mutex_lock(shrinker_mutex) expand_shrinker_info --> mem_cgroup_iter see the memcg expand_one_shrinker_info --> old0 = C->node0->shrinker_info memcpy(new->unit, old0->unit, ...); free_shrinker_info --> kvfree(old0); /* double free !! */ kvfree_rcu(old0, rcu); The same problem exists later in mem_cgroup_css_online(). If alloc_shrinker_info() succeeds but a subsequent objcg allocation fails, the free_objcg -> free_shrinker_info() unwind path tears down the already published pn->shrinker_info arrays without shrinker_mutex. The expand_one_shrinker_info() can race with that teardown in the same way, leading to use-after-free or double-free of the old shrinker_info. Fix this by serializing shrinker_info teardown with shrinker_mutex, and by keeping alloc_shrinker_info() error cleanup inside the locked section.
Title		mm: shrinker: fix shrinker_info teardown race with expansion
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947 https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875 https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:57.594Z

Updated: 2026-08-05T12:41:50.196Z

Reserved: 2026-07-19T15:36:31.786Z

Link: CVE-2026-64418

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:25.727

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64418

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64418 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T19:00:05Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object