CVE-2026-64419: Linux Kernel Race Condition Vulnerability

CVE-2026-64419 Overview

CVE-2026-64419 is a Linux kernel bug in the memory management shrinker subsystem. Reading the debugfs count file of a memcg-aware shrinker triggers a sleeping function inside an RCU read-side critical section. The shrinker_debugfs_count_show() function invokes the ->count_objects() callback under rcu_read_lock(). For zswap, that callback flushes memcg statistics via css_rstat_flush(), which may sleep. The result is an invalid-context BUG in kernel/cgroup/rstat.c:421 reported by the kernel scheduler. The fix removes the unnecessary RCU section around the callback invocation.

Critical Impact
Local users with access to shrinker debugfs entries can trigger a kernel warning or scheduling-in-atomic-context BUG that may destabilize the running kernel.

Affected Products

Linux kernel with memcg-aware shrinker debugfs support
Kernels enabling CONFIG_MEMCG together with zswap shrinker functionality
Distributions shipping affected upstream stable branches prior to the referenced patches

Discovery Timeline

2026-07-25 - CVE-2026-64419 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64419

Vulnerability Analysis

The defect resides in mm/shrinker debugfs read handling. shrinker_debugfs_count_show() iterates memcgs and calls the shrinker's ->count_objects() callback while holding rcu_read_lock(). RCU read-side critical sections must remain non-preemptible and non-sleeping. The zswap shrinker's zswap_shrinker_count() calls mem_cgroup_flush_stats(), which reaches css_rstat_flush(). That path can sleep waiting on per-cgroup locks and rstat propagation. The mismatch produces a BUG: sleeping function called from invalid context diagnostic with RCU nest depth: 1, expected: 0.

Root Cause

The RCU lock in shrinker_debugfs_count_show() is redundant. mem_cgroup_iter() handles RCU internally and returns a memcg with an elevated css reference count, keeping the object alive across the iteration boundary. The shrinker itself is held alive by the open debugfs file, since shrinker_free() calls debugfs_remove_recursive() before scheduling call_rcu(..., shrinker_free_rcu_cb), draining in-flight readers. The sibling scan handler already invokes ->scan_objects() without any RCU section, confirming the lock is unnecessary. Holding RCU while calling a sleeping callback violates kernel locking discipline [CWE-667].

Attack Vector

A local user with read access to /sys/kernel/debug/shrinker/*/count can trigger the invalid-context path when a memcg-aware shrinker (such as zswap) is registered. debugfs typically requires root or CAP_SYS_ADMIN, limiting the attack surface to privileged local contexts. Successful triggering yields kernel warnings or a scheduling BUG, contributing to denial of service or masking of other kernel issues in monitoring stacks.

No verified exploit code is available. The vulnerability is described in the upstream commit messages referenced below.

Detection Methods for CVE-2026-64419

Indicators of Compromise

Kernel log entries containing BUG: sleeping function called from invalid context at kernel/cgroup/rstat.c
Stack traces including css_rstat_flush, mem_cgroup_flush_stats, zswap_shrinker_count, and shrinker_debugfs_count_show
Repeated RCU nest depth: 1, expected: 0 messages tied to debugfs reads

Detection Strategies

Audit access to /sys/kernel/debug/shrinker/ and correlate reads with subsequent kernel warnings
Monitor dmesg and journald for scheduling-in-atomic-context diagnostics on hosts using zswap
Track kernel build versions against the upstream stable patches referenced in this advisory

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on sleeping function called from invalid context patterns
Baseline debugfs access on production hosts and flag processes reading shrinker count files
Include kernel version inventories in vulnerability management scans to identify unpatched hosts

How to Mitigate CVE-2026-64419

Immediate Actions Required

Apply the upstream stable patches listed in the Patch Information section as soon as they are available from your distribution
Restrict access to /sys/kernel/debug/ to root only and unmount debugfs on production systems that do not require it
Disable zswap or memcg-aware shrinker debug interfaces where they are not operationally needed

Patch Information

Upstream fixes drop the rcu_read_lock()/rcu_read_unlock() pair around the ->count_objects() callback in shrinker_debugfs_count_show(). Reference commits: Kernel Patch 2fed79f0, Kernel Patch 560e21e8, Kernel Patch 86237e56, Kernel Patch b902890c, Kernel Patch de5f69b8, and Kernel Patch e441cbfb.

Workarounds

Unmount debugfs on production hosts: umount /sys/kernel/debug
Restrict debugfs permissions so only root can read shrinker entries
Avoid enabling the zswap shrinker path on hosts where the kernel is not yet patched

bash

# Configuration example: tighten debugfs access on affected hosts
mount -o remount,mode=700 /sys/kernel/debug
chmod 700 /sys/kernel/debug
# Optional: unmount entirely if debugfs is not required
umount /sys/kernel/debug