CVE-2026-64417mm: shrinker: fix NULL pointer dereference in debugfs
- 5.5MediumCVSS base score
- 0.12%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinker_debugfs_add() creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both count_objects() and scan_objects(), which is not guaranteed. For example, the xen-backend shrinker sets count_objects() but leaves scan_objects() NULL, so writing to its scan file calls through a NULL function pointer and panics the kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. Call Trace: <TASK> shrinker_debugfs_scan_write+0x12e/0x270 full_proxy_write+0x5f/0x90 vfs_write+0xde/0x420 ? filp_flush+0x75/0x90 ? filp_close+0x1d/0x30 ? do_dup2+0xb8/0x120 ksys_write+0x68/0xf0 ? filp_flush+0x75/0x90 do_syscall_64+0xb3/0x5b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The count path has the same issue in principle if a shrinker omits count_objects(). To fix it, only create "count" and "scan" debugfs files when the corresponding callbacks are present.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 23 days later
· 23 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.12% · top 98% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 – < ebb45c2648b1f60715fd283700f651e05e431231
- affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 – < 09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9
- affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 – < 36f8534f461222291a74156ab91f3ba9f09b6f93
- affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 – < 006467ab932698612398f853344a7405164541f4
- affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 – < b9beed2322f3538b0d2d53307062da4102b8d8d8
- affected bbf535fd6f06b94b9d07ed6f09397a936d4a58d8 – < e30453c61e185e914fde83c650e268067b140218
- affected 6.0
- unaffected < 6.0
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.96 – ≤ 6.12.*
- unaffected 6.18.39 – ≤ 6.18.*
- unaffected 7.1.4 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References6
- https://git.kernel.org/stable/c/ebb45c2648b1f60715fd283700f651e05e431231 (opens in a new tab)
- https://git.kernel.org/stable/c/09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9 (opens in a new tab)
- https://git.kernel.org/stable/c/36f8534f461222291a74156ab91f3ba9f09b6f93 (opens in a new tab)
- https://git.kernel.org/stable/c/006467ab932698612398f853344a7405164541f4 (opens in a new tab)
- https://git.kernel.org/stable/c/b9beed2322f3538b0d2d53307062da4102b8d8d8 (opens in a new tab)
- https://git.kernel.org/stable/c/e30453c61e185e914fde83c650e268067b140218 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-48961 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64417)Record last updated .