CVE-2026-64417: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64417 Overview

CVE-2026-64417 is a NULL pointer dereference vulnerability in the Linux kernel's memory management shrinker debugfs interface. The flaw resides in shrinker_debugfs_add(), which unconditionally creates both count and scan debugfs files for every registered shrinker. This assumption fails when a shrinker implementation omits either count_objects() or scan_objects() callbacks. The xen-backend shrinker triggers the issue by registering count_objects() while leaving scan_objects() set to NULL. Writing to the exposed scan file dispatches through the NULL function pointer and panics the kernel.

Critical Impact
A local user with access to shrinker debugfs files can trigger a kernel NULL pointer dereference, causing a denial-of-service kernel panic on affected Linux systems.

Affected Products

Linux kernel versions containing the shrinker_debugfs_add() implementation prior to the fix
Systems using the xen-backend shrinker or any shrinker that omits scan_objects() or count_objects()
Distributions shipping vulnerable stable kernels referenced in the upstream commits

Discovery Timeline

2026-07-25 - CVE-2026-64417 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64417

Vulnerability Analysis

The Linux kernel exposes shrinker instrumentation through debugfs to help developers observe memory reclaim behavior. The registration helper shrinker_debugfs_add() creates two files per shrinker: count and scan. Both files are wired to proxy handlers that invoke the shrinker's callbacks when userspace reads or writes them.

The defect is an incorrect assumption about shrinker interface completeness. Several in-tree shrinkers implement only one half of the interface. For example, xen-backend provides count_objects() but sets scan_objects() to NULL. Because the scan debugfs entry is created regardless, a write to that file reaches shrinker_debugfs_scan_write(), which then calls an unset function pointer.

The resulting kernel oops surfaces as BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:0x0, followed by a call trace through shrinker_debugfs_scan_write, full_proxy_write, vfs_write, and ksys_write. The panic terminates kernel execution and interrupts service availability.

Root Cause

The root cause is missing callback validation during debugfs file creation [CWE-476]. shrinker_debugfs_add() creates the count and scan interfaces unconditionally rather than checking whether the associated count_objects and scan_objects function pointers are populated. Any subsequent access to the file that lacks a backing callback dereferences NULL in kernel context.

Attack Vector

Exploitation requires local access with permissions to write to files under /sys/kernel/debug/shrinker/. Debugfs is typically restricted to root, which limits the attack surface. However, on systems where debugfs is mounted and accessible to privileged debugging accounts or containers with relaxed capabilities, a single write() syscall against the affected shrinker's scan node crashes the host kernel. No exploit or proof-of-concept has been published in Exploit-DB, and CISA has not added the issue to the Known Exploited Vulnerabilities catalog.

The upstream fix creates the count and scan debugfs files only when the corresponding callbacks are present. Refer to the Kernel Git Commit 36f8534f and related stable backports for the exact patch.

Detection Methods for CVE-2026-64417

Indicators of Compromise

Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:0x0
Call traces referencing shrinker_debugfs_scan_write+0x12e/0x270 followed by full_proxy_write and vfs_write
Unexpected kernel panics or system reboots correlated with access to /sys/kernel/debug/shrinker/ paths

Detection Strategies

Monitor dmesg and journald for oops entries that reference shrinker_debugfs_scan_write or shrinker_debugfs_count_write symbols
Audit filesystem access to /sys/kernel/debug/shrinker/*/scan and /sys/kernel/debug/shrinker/*/count using auditd rules
Track running kernel versions across the fleet and flag hosts running builds that predate the referenced stable commits

Monitoring Recommendations

Forward kernel ring buffer output to a centralized logging platform for correlation of panics with process activity
Alert on repeated writes to shrinker debugfs paths from non-maintenance accounts or container workloads
Include kernel crash dumps (kdump) collection so post-mortem analysis can confirm the NULL dereference signature

How to Mitigate CVE-2026-64417

Immediate Actions Required

Apply vendor-supplied kernel updates that incorporate the upstream fix from the referenced stable commits
Restrict debugfs mount access to root only and ensure /sys/kernel/debug is not exposed inside unprivileged containers
Inventory shrinkers loaded on affected hosts and identify any that omit scan_objects() or count_objects()

Patch Information

The fix is available in the mainline Linux kernel and backported to stable branches. Review the upstream commits at Kernel Git Commit 006467ab, Kernel Git Commit 09d24079, Kernel Git Commit 36f8534f, Kernel Git Commit b9beed23, Kernel Git Commit e30453c6, and Kernel Git Commit ebb45c26. Rebuild or install distribution kernels that include these commits and reboot to activate the patched image.

Workarounds

Unmount debugfs where it is not required: umount /sys/kernel/debug and remove any persistent mount entries
Tighten permissions on /sys/kernel/debug so only root (UID 0) has read or write access
Ensure container runtimes do not bind-mount /sys/kernel/debug into workloads and drop the SYS_ADMIN capability where possible

bash

# Restrict debugfs access until the patched kernel is deployed
mount -o remount,mode=700 /sys/kernel/debug
chown root:root /sys/kernel/debug
chmod 700 /sys/kernel/debug