CVE-2026-64418 (GCVE-0-2026-64418)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:55
VLAI
Title
mm: shrinker: fix shrinker_info teardown race with expansion
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race with expansion expand_shrinker_info() iterates all visible memcgs under shrinker_mutex, including memcgs that have not finished ->css_online() yet. Once pn->shrinker_info has been published, teardown must stay serialized with expand_shrinker_info() until that memcg is either fully online or no longer visible to iteration. Today alloc_shrinker_info() breaks that rule by dropping shrinker_mutex before freeing a partially initialized shrinker_info array, which may cause the following race: CPU0 CPU1 ==== ==== css_create --> list_add_tail_rcu(&css->sibling, &parent_css->children); online_css --> mem_cgroup_css_online --> alloc_shrinker_info --> alloc node0 info rcu_assign_pointer(C->node0->shrinker_info, old0) alloc node1 info -> FAIL -> goto err mutex_unlock(shrinker_mutex) shrinker_alloc() --> shrinker_memcg_alloc --> mutex_lock(shrinker_mutex) expand_shrinker_info --> mem_cgroup_iter see the memcg expand_one_shrinker_info --> old0 = C->node0->shrinker_info memcpy(new->unit, old0->unit, ...); free_shrinker_info --> kvfree(old0); /* double free !! */ kvfree_rcu(old0, rcu); The same problem exists later in mem_cgroup_css_online(). If alloc_shrinker_info() succeeds but a subsequent objcg allocation fails, the free_objcg -> free_shrinker_info() unwind path tears down the already published pn->shrinker_info arrays without shrinker_mutex. The expand_one_shrinker_info() can race with that teardown in the same way, leading to use-after-free or double-free of the old shrinker_info. Fix this by serializing shrinker_info teardown with shrinker_mutex, and by keeping alloc_shrinker_info() error cleanup inside the locked section.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 307bececcd1205bcb67a3c0d53a69db237ccc9d4 , < b9a280a9a454ed514636351d53fe2a233dc5054b (git)
Affected: 307bececcd1205bcb67a3c0d53a69db237ccc9d4 , < 6465ff3ce65131c774a312d450abe10f4b9f3875 (git)
Affected: 307bececcd1205bcb67a3c0d53a69db237ccc9d4 , < 284c267f013e45d8c89d9fb9373105dc8e6c0947 (git)
Affected: 307bececcd1205bcb67a3c0d53a69db237ccc9d4 , < 65476d31d8056e859c48580f82295ce159196ffe (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b9a280a9a454ed514636351d53fe2a233dc5054b",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "6465ff3ce65131c774a312d450abe10f4b9f3875",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "284c267f013e45d8c89d9fb9373105dc8e6c0947",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "65476d31d8056e859c48580f82295ce159196ffe",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix shrinker_info teardown race with expansion\n\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\nincluding memcgs that have not finished -\u003ecss_online() yet.\n\nOnce pn-\u003eshrinker_info has been published, teardown must stay serialized\nwith expand_shrinker_info() until that memcg is either fully online or no\nlonger visible to iteration.  Today alloc_shrinker_info() breaks that rule\nby dropping shrinker_mutex before freeing a partially initialized\nshrinker_info array, which may cause the following race:\n\nCPU0                   CPU1\n====                   ====\n\ncss_create\n--\u003e list_add_tail_rcu(\u0026css-\u003esibling, \u0026parent_css-\u003echildren);\n    online_css\n    --\u003e mem_cgroup_css_online\n        --\u003e alloc_shrinker_info\n            --\u003e alloc node0 info\n                rcu_assign_pointer(C-\u003enode0-\u003eshrinker_info, old0)\n                alloc node1 info -\u003e FAIL -\u003e goto err\n                mutex_unlock(shrinker_mutex)\n\n                       shrinker_alloc()\n                       --\u003e shrinker_memcg_alloc\n                           --\u003e mutex_lock(shrinker_mutex)\n                               expand_shrinker_info\n                               --\u003e mem_cgroup_iter see the memcg\n                                   expand_one_shrinker_info\n                                   --\u003e old0 = C-\u003enode0-\u003eshrinker_info\n                                       memcpy(new-\u003eunit, old0-\u003eunit, ...);\n\n                free_shrinker_info\n                --\u003e kvfree(old0);\n\n                                       /* double free !! */\n                                       kvfree_rcu(old0, rcu);\n\nThe same problem exists later in mem_cgroup_css_online().  If\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\nthe free_objcg -\u003e free_shrinker_info() unwind path tears down the already\npublished pn-\u003eshrinker_info arrays without shrinker_mutex.  The\nexpand_one_shrinker_info() can race with that teardown in the same way,\nleading to use-after-free or double-free of the old shrinker_info.\n\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\nkeeping alloc_shrinker_info() error cleanup inside the locked section."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reachable through local cgroup mkdir operations raced against memcg-aware shrinker allocation, such as mounting new tmpfs instances.\nAC:L - An attacker can repeatedly create cgroups, induce allocation pressure, and concurrently allocate shrinkers, controlling both sides of the race and widening it through repetition.\nPR:L - An unprivileged user with a delegated cgroup v2 subtree can create memory cgroups, while user namespaces provide the capability needed to mount user-namespace-enabled filesystems.\nUI:N - Exploitation requires no action by another user once the attacker can execute the concurrent local operations.\nS:U - The corruption occurs within the kernel and represents ordinary local privilege escalation within the same security authority.\nC:H - The use-after-free and delayed double-free permit heap reuse and manipulation of dangling shrinker unit pointers, potentially enabling arbitrary kernel-memory disclosure.\nI:H - The dangling pointers, atomic operations on freed units, and double-free can provide arbitrary kernel-memory corruption and control-flow hijacking.\nA:H - The use-after-free or double-free can directly cause a kernel oops, panic, or other system-wide failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:17.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875"
        },
        {
          "url": "https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947"
        },
        {
          "url": "https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe"
        }
      ],
      "title": "mm: shrinker: fix shrinker_info teardown race with expansion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64418",
    "datePublished": "2026-07-25T08:50:57.594Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-17T04:55:17.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64418",
      "date": "2026-09-21",
      "epss": "0.00097",
      "percentile": "0.00824"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "mm/shrinker.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b9a280a9a454ed514636351d53fe2a233dc5054b",
                    "status": "affected",
                    "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6465ff3ce65131c774a312d450abe10f4b9f3875",
                    "status": "affected",
                    "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "284c267f013e45d8c89d9fb9373105dc8e6c0947",
                    "status": "affected",
                    "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "65476d31d8056e859c48580f82295ce159196ffe",
                    "status": "affected",
                    "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "mm/shrinker.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix shrinker_info teardown race with expansion\n\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\nincluding memcgs that have not finished -\u003ecss_online() yet.\n\nOnce pn-\u003eshrinker_info has been published, teardown must stay serialized\nwith expand_shrinker_info() until that memcg is either fully online or no\nlonger visible to iteration.  Today alloc_shrinker_info() breaks that rule\nby dropping shrinker_mutex before freeing a partially initialized\nshrinker_info array, which may cause the following race:\n\nCPU0                   CPU1\n====                   ====\n\ncss_create\n--\u003e list_add_tail_rcu(\u0026css-\u003esibling, \u0026parent_css-\u003echildren);\n    online_css\n    --\u003e mem_cgroup_css_online\n        --\u003e alloc_shrinker_info\n            --\u003e alloc node0 info\n                rcu_assign_pointer(C-\u003enode0-\u003eshrinker_info, old0)\n                alloc node1 info -\u003e FAIL -\u003e goto err\n                mutex_unlock(shrinker_mutex)\n\n                       shrinker_alloc()\n                       --\u003e shrinker_memcg_alloc\n                           --\u003e mutex_lock(shrinker_mutex)\n                               expand_shrinker_info\n                               --\u003e mem_cgroup_iter see the memcg\n                                   expand_one_shrinker_info\n                                   --\u003e old0 = C-\u003enode0-\u003eshrinker_info\n                                       memcpy(new-\u003eunit, old0-\u003eunit, ...);\n\n                free_shrinker_info\n                --\u003e kvfree(old0);\n\n                                       /* double free !! */\n                                       kvfree_rcu(old0, rcu);\n\nThe same problem exists later in mem_cgroup_css_online().  If\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\nthe free_objcg -\u003e free_shrinker_info() unwind path tears down the already\npublished pn-\u003eshrinker_info arrays without shrinker_mutex.  The\nexpand_one_shrinker_info() can race with that teardown in the same way,\nleading to use-after-free or double-free of the old shrinker_info.\n\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\nkeeping alloc_shrinker_info() error cleanup inside the locked section."
          }
        ],
        "id": "CVE-2026-64418",
        "lastModified": "2026-09-04T15:24:49.577",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:25.727",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T14:16:59+00:00",
      "cve": "CVE-2026-64418",
      "id": "CVE-2026-64418",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: shrinker: fix shrinker_info teardown race with expansion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64418.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:49:18Z",
      "cve": "CVE-2026-64418",
      "id": "CVE-2026-64418",
      "initial_release_date": "2026-07-25T15:59:43Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "347",
      "product_status:recommended": "46",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64418",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64418.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.