CVE-2026-64418: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64418 Overview

CVE-2026-64418 is a race condition vulnerability in the Linux kernel's memory management shrinker subsystem. The flaw exists in expand_shrinker_info() and alloc_shrinker_info(), where teardown of a partially initialized shrinker_info array occurs without holding shrinker_mutex. This creates a window where concurrent expansion on another CPU can access memory that is being freed, resulting in a use-after-free or double-free condition on the shrinker_info structure tied to a memory control group (memcg).

Critical Impact
Local attackers with low privileges can trigger memory corruption in the kernel, potentially leading to privilege escalation, kernel information disclosure, or system crashes.

Affected Products

Linux kernel (mainline) with memcg-aware shrinker infrastructure
Stable kernel branches referenced in the patch commits
Distributions shipping vulnerable kernel versions prior to the fix

Discovery Timeline

2026-07-25 - CVE-2026-64418 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64418

Vulnerability Analysis

The vulnerability resides in the Linux kernel's shrinker subsystem, which manages reclaimable slab caches associated with memory cgroups. When a new memcg is created, mem_cgroup_css_online() calls alloc_shrinker_info() to allocate per-node shrinker_info arrays. On another CPU, shrinker_alloc() can invoke expand_shrinker_info(), which iterates all visible memcgs under shrinker_mutex, including those whose ->css_online() has not yet completed.

The corruption occurs when alloc_shrinker_info() publishes the node0 array via rcu_assign_pointer(), fails on node1 allocation, and then drops shrinker_mutex before freeing the partially initialized structure. During that unlocked window, expand_one_shrinker_info() reads the published pointer and copies its contents, while the failing allocator concurrently calls kvfree() and kvfree_rcu() on the same object.

A similar unwind path exists when an objcg allocation fails after alloc_shrinker_info() succeeds. The free_objcg -> free_shrinker_info() cleanup releases already-published pn->shrinker_info arrays without holding shrinker_mutex, exposing the same race.

Root Cause

The root cause is improper serialization of memory reclaim teardown against concurrent expansion. Once pn->shrinker_info is published via RCU, any teardown must remain serialized with expand_shrinker_info() until the memcg is fully online or removed from iteration. Dropping shrinker_mutex before freeing partially initialized state violates this invariant.

Attack Vector

Exploitation requires local access with the ability to create memory cgroups and trigger shrinker registration. An unprivileged user in a namespace with cgroup delegation, or a container workload, can race memcg creation against shrinker registration to trigger the double-free. Successful exploitation may allow kernel heap corruption leading to local privilege escalation.

The vulnerability is documented in the upstream Linux kernel fix. See Linux Kernel Commit b9a280a and Linux Kernel Commit 6465ff3 for the technical patches.

Detection Methods for CVE-2026-64418

Indicators of Compromise

Kernel oops or panic messages referencing expand_shrinker_info, free_shrinker_info, or kvfree_rcu in dmesg
KASAN reports of use-after-free or double-free involving shrinker_info allocations
Unexplained kernel crashes during high memcg churn, such as container start/stop storms

Detection Strategies

Enable CONFIG_KASAN in test environments to surface the race on affected kernels
Audit running kernel versions across the fleet and compare against the fixed stable branches referenced in the patch commits
Monitor host telemetry for repeated kernel warnings or crashes originating from the memory management subsystem

Monitoring Recommendations

Correlate kernel crash telemetry with workloads that heavily create and destroy cgroups, including container runtimes and Kubernetes nodes
Track unprivileged processes performing frequent mkdir operations under /sys/fs/cgroup hierarchies
Alert on kernel log entries containing BUG:, WARNING:, or general protection fault tied to slab or shrinker call paths

How to Mitigate CVE-2026-64418

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE record to all affected hosts
Prioritize patching container hosts and multi-tenant systems where untrusted workloads can create cgroups
Restart affected systems after kernel updates to activate the patched code path

Patch Information

The fix serializes shrinker_info teardown with shrinker_mutex and keeps alloc_shrinker_info() error cleanup inside the locked section. The patches are available in the mainline kernel and backported to stable branches: commit 284c267, commit 6465ff3, commit 65476d3, and commit b9a280a. Consult your Linux distribution's security tracker for backported package versions.

Workarounds

Restrict unprivileged user namespace creation via sysctl -w kernel.unprivileged_userns_clone=0 where supported
Limit cgroup delegation to trusted users and services to reduce the attack surface
Constrain container runtime privileges and disable memory controller delegation for untrusted tenants where feasible

bash

# Configuration example
# Verify current kernel version against fixed releases
uname -r

# Restrict unprivileged user namespaces (Debian/Ubuntu)
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2026-64418.conf

# Apply distribution kernel update
sudo apt update && sudo apt upgrade linux-image-generic  # Debian/Ubuntu
sudo dnf update kernel                                    # RHEL/Fedora
sudo reboot