CVE-2026-64416: Linux Kernel DOS Vulnerability

CVE-2026-64416 Overview

CVE-2026-64416 is a NULL pointer dereference vulnerability in the Linux kernel's memory management subsystem, specifically within the swap_cgroup code path. The flaw resides in lookup_swap_cgroup_id(), which forwards swap_cgroup_ctrl[type].map to __swap_cgroup_id_lookup() without validating that the swap type was ever registered via swap_cgroup_swapon(). On a swapless host, every ctrl->map is NULL, so the lookup dereferences NULL plus a scaled swp_offset(), triggering a page fault at process teardown.

Critical Impact
A single corrupted page table entry that decodes as a type-0 swap entry can crash a swapless Linux host during process exit, producing a denial-of-service condition.

Affected Products

Linux kernel (mainline)
Linux kernel 6.12.x stable series (confirmed on 6.12.58 in production)
Linux kernel stable branches receiving the referenced backports

Discovery Timeline

2026-07-25 - CVE-2026-64416 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64416

Vulnerability Analysis

The defect lives in mm/swap_cgroup.c. The function lookup_swap_cgroup_id() is expected to return the memory cgroup ID associated with a swap entry. It reaches into the per-type control array swap_cgroup_ctrl[type] and hands the .map pointer to __swap_cgroup_id_lookup() without confirming the swap area was ever activated. Prior to commit bea67dcc5eea ("mm: attempt to batch free swap entries for zap_pte_range()"), callers were downstream of get_swap_device(), which validates the entry. That commit added a new call site in swap_pte_batch() that operates on any non-present, non-none page table entry decoded as a real swap entry, bypassing swap area validation.

Root Cause

The root cause is a missing precondition check. On systems where no swap device is registered, every swap_cgroup_ctrl[type].map is NULL. When __swap_cgroup_id_lookup() computes map[swp_offset >> SC_PER_PAGE_SHIFT], it dereferences NULL offset by a scaled swap offset, producing an unhandled kernel page fault at addresses such as 0x000003f800204220.

Attack Vector

Exploitation requires the kernel to encounter a corrupted PTE that decodes as a valid swap entry. The teardown path exit_mmap() → unmap_page_range() → zap_pte_range() → swap_pte_batch() calls lookup_swap_cgroup_id() on such entries. A single PTE corrupted into a type-0 swap entry on a swapless host causes a kernel oops during process exit. The corruption source is a separate bug; this patch hardens the teardown path to match the defensive checks already present in do_swap_page(). syzbot has reproduced the identical crash stack, and the reporter observed it in production on a 6.12.58 kernel.

The patch adds an explicit check that the swap type's map is non-NULL before dereferencing it. Refer to the upstream commits b415c00bf23d, 818416fef38, 6a4196d19f4, and 63b02a9409c for the fix.

Detection Methods for CVE-2026-64416

Indicators of Compromise

Kernel log entries reading get_swap_device: Bad swap file entry repeated at high frequency (approximately once per second) immediately preceding the crash.
Kernel BUG: unable to handle page fault for address: messages with RIP: lookup_swap_cgroup_id+0x2b/0x60 in the faulting instruction.
Call trace frames containing swap_pte_batch, zap_pte_range, unmap_page_range, exit_mmap, and do_exit.
Unexpected host reboots or panics correlated with process termination on swapless systems.

Detection Strategies

Collect and centralize kernel ring buffer output (dmesg, journalctl -k) and alert on the signature strings above.
Correlate Bad swap file entry messages with the affected process ID and image name to identify tenants triggering the fault.
Track kernel crash artifacts (kdump, /var/crash) for stack traces matching the lookup_swap_cgroup_id frame.

Monitoring Recommendations

Forward kernel logs from all Linux hosts to a centralized logging platform for retention and query.
Baseline swap configuration inventory to identify swapless hosts running unpatched 6.12.x or affected stable kernels.
Alert on repeated kernel oops or panic events on production Linux fleets to catch this class of memory management regression early.

How to Mitigate CVE-2026-64416

Immediate Actions Required

Apply the upstream stable kernel updates that include commits b415c00bf23d, 818416fef38, 6a4196d19f4, and 63b02a9409c.
Prioritize patching for swapless hosts running Linux 6.12.x stable series, which is the confirmed vulnerable configuration.
Enable kernel crash dump collection (kdump) to capture forensic data if the fault recurs before patch rollout.

Patch Information

The fix adds a NULL check before dereferencing swap_cgroup_ctrl[type].map in lookup_swap_cgroup_id(). Distribution vendors will backport the patch through their stable kernel channels. Consult the upstream references: Kernel Git Commit b415c00bf23d, Kernel Git Commit 818416fef38, Kernel Git Commit 6a4196d19f4, and Kernel Git Commit 63b02a9409c.

Workarounds

Enable a swap device on affected hosts. Registering any swap area causes swap_cgroup_swapon() to allocate a valid map, avoiding the NULL dereference on that type.
Investigate and remediate the upstream source of PTE corruption on affected systems, since the crash requires a corrupted swap entry to trigger.
Restrict untrusted workloads on unpatched hosts to reduce the chance of triggering PTE corruption prior to remediation.

bash

# Verify running kernel version and swap configuration
uname -r
swapon --show

# Enable a small swap file as a temporary mitigation on swapless hosts
fallocate -l 512M /var/swapfile
chmod 600 /var/swapfile
mkswap /var/swapfile
swapon /var/swapfile