Vulnerability-Lookup

CVE-2026-64418 (GCVE-0-2026-64418)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-07-25 08:50

Title

mm: shrinker: fix shrinker_info teardown race with expansion

Summary

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race with expansion expand_shrinker_info() iterates all visible memcgs under shrinker_mutex, including memcgs that have not finished ->css_online() yet. Once pn->shrinker_info has been published, teardown must stay serialized with expand_shrinker_info() until that memcg is either fully online or no longer visible to iteration. Today alloc_shrinker_info() breaks that rule by dropping shrinker_mutex before freeing a partially initialized shrinker_info array, which may cause the following race: CPU0 CPU1 ==== ==== css_create --> list_add_tail_rcu(&css->sibling, &parent_css->children); online_css --> mem_cgroup_css_online --> alloc_shrinker_info --> alloc node0 info rcu_assign_pointer(C->node0->shrinker_info, old0) alloc node1 info -> FAIL -> goto err mutex_unlock(shrinker_mutex) shrinker_alloc() --> shrinker_memcg_alloc --> mutex_lock(shrinker_mutex) expand_shrinker_info --> mem_cgroup_iter see the memcg expand_one_shrinker_info --> old0 = C->node0->shrinker_info memcpy(new->unit, old0->unit, ...); free_shrinker_info --> kvfree(old0); /* double free !! */ kvfree_rcu(old0, rcu); The same problem exists later in mem_cgroup_css_online(). If alloc_shrinker_info() succeeds but a subsequent objcg allocation fails, the free_objcg -> free_shrinker_info() unwind path tears down the already published pn->shrinker_info arrays without shrinker_mutex. The expand_one_shrinker_info() can race with that teardown in the same way, leading to use-after-free or double-free of the old shrinker_info. Fix this by serializing shrinker_info teardown with shrinker_mutex, and by keeping alloc_shrinker_info() error cleanup inside the locked section.

Severity

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/b9a280a9a454ed514…
https://git.kernel.org/stable/c/6465ff3ce65131c77…
https://git.kernel.org/stable/c/284c267f013e45d8c…
https://git.kernel.org/stable/c/65476d31d8056e859…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 307bececcd1205bcb67a3c0d53a69db237ccc9d4 , < b9a280a9a454ed514636351d53fe2a233dc5054b (git) Affected: 307bececcd1205bcb67a3c0d53a69db237ccc9d4 , < 6465ff3ce65131c774a312d450abe10f4b9f3875 (git) Affected: 307bececcd1205bcb67a3c0d53a69db237ccc9d4 , < 284c267f013e45d8c89d9fb9373105dc8e6c0947 (git) Affected: 307bececcd1205bcb67a3c0d53a69db237ccc9d4 , < 65476d31d8056e859c48580f82295ce159196ffe (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b9a280a9a454ed514636351d53fe2a233dc5054b",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "6465ff3ce65131c774a312d450abe10f4b9f3875",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "284c267f013e45d8c89d9fb9373105dc8e6c0947",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "65476d31d8056e859c48580f82295ce159196ffe",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix shrinker_info teardown race with expansion\n\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\nincluding memcgs that have not finished -\u003ecss_online() yet.\n\nOnce pn-\u003eshrinker_info has been published, teardown must stay serialized\nwith expand_shrinker_info() until that memcg is either fully online or no\nlonger visible to iteration.  Today alloc_shrinker_info() breaks that rule\nby dropping shrinker_mutex before freeing a partially initialized\nshrinker_info array, which may cause the following race:\n\nCPU0                   CPU1\n====                   ====\n\ncss_create\n--\u003e list_add_tail_rcu(\u0026css-\u003esibling, \u0026parent_css-\u003echildren);\n    online_css\n    --\u003e mem_cgroup_css_online\n        --\u003e alloc_shrinker_info\n            --\u003e alloc node0 info\n                rcu_assign_pointer(C-\u003enode0-\u003eshrinker_info, old0)\n                alloc node1 info -\u003e FAIL -\u003e goto err\n                mutex_unlock(shrinker_mutex)\n\n                       shrinker_alloc()\n                       --\u003e shrinker_memcg_alloc\n                           --\u003e mutex_lock(shrinker_mutex)\n                               expand_shrinker_info\n                               --\u003e mem_cgroup_iter see the memcg\n                                   expand_one_shrinker_info\n                                   --\u003e old0 = C-\u003enode0-\u003eshrinker_info\n                                       memcpy(new-\u003eunit, old0-\u003eunit, ...);\n\n                free_shrinker_info\n                --\u003e kvfree(old0);\n\n                                       /* double free !! */\n                                       kvfree_rcu(old0, rcu);\n\nThe same problem exists later in mem_cgroup_css_online().  If\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\nthe free_objcg -\u003e free_shrinker_info() unwind path tears down the already\npublished pn-\u003eshrinker_info arrays without shrinker_mutex.  The\nexpand_one_shrinker_info() can race with that teardown in the same way,\nleading to use-after-free or double-free of the old shrinker_info.\n\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\nkeeping alloc_shrinker_info() error cleanup inside the locked section."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T08:50:57.594Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875"
        },
        {
          "url": "https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947"
        },
        {
          "url": "https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe"
        }
      ],
      "title": "mm: shrinker: fix shrinker_info teardown race with expansion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64418",
    "datePublished": "2026-07-25T08:50:57.594Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-07-25T08:50:57.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64418",
      "date": "2026-07-26",
      "epss": "0.00168",
      "percentile": "0.06412"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64418\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:25.727\",\"lastModified\":\"2026-07-25T10:17:25.727\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: shrinker: fix shrinker_info teardown race with expansion\\n\\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\\nincluding memcgs that have not finished -\u003ecss_online() yet.\\n\\nOnce pn-\u003eshrinker_info has been published, teardown must stay serialized\\nwith expand_shrinker_info() until that memcg is either fully online or no\\nlonger visible to iteration.  Today alloc_shrinker_info() breaks that rule\\nby dropping shrinker_mutex before freeing a partially initialized\\nshrinker_info array, which may cause the following race:\\n\\nCPU0                   CPU1\\n====                   ====\\n\\ncss_create\\n--\u003e list_add_tail_rcu(\u0026css-\u003esibling, \u0026parent_css-\u003echildren);\\n    online_css\\n    --\u003e mem_cgroup_css_online\\n        --\u003e alloc_shrinker_info\\n            --\u003e alloc node0 info\\n                rcu_assign_pointer(C-\u003enode0-\u003eshrinker_info, old0)\\n                alloc node1 info -\u003e FAIL -\u003e goto err\\n                mutex_unlock(shrinker_mutex)\\n\\n                       shrinker_alloc()\\n                       --\u003e shrinker_memcg_alloc\\n                           --\u003e mutex_lock(shrinker_mutex)\\n                               expand_shrinker_info\\n                               --\u003e mem_cgroup_iter see the memcg\\n                                   expand_one_shrinker_info\\n                                   --\u003e old0 = C-\u003enode0-\u003eshrinker_info\\n                                       memcpy(new-\u003eunit, old0-\u003eunit, ...);\\n\\n                free_shrinker_info\\n                --\u003e kvfree(old0);\\n\\n                                       /* double free !! */\\n                                       kvfree_rcu(old0, rcu);\\n\\nThe same problem exists later in mem_cgroup_css_online().  If\\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\\nthe free_objcg -\u003e free_shrinker_info() unwind path tears down the already\\npublished pn-\u003eshrinker_info arrays without shrinker_mutex.  The\\nexpand_one_shrinker_info() can race with that teardown in the same way,\\nleading to use-after-free or double-free of the old shrinker_info.\\n\\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\\nkeeping alloc_shrinker_info() error cleanup inside the locked section.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/shrinker.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"307bececcd1205bcb67a3c0d53a69db237ccc9d4\",\"lessThan\":\"b9a280a9a454ed514636351d53fe2a233dc5054b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"307bececcd1205bcb67a3c0d53a69db237ccc9d4\",\"lessThan\":\"6465ff3ce65131c774a312d450abe10f4b9f3875\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"307bececcd1205bcb67a3c0d53a69db237ccc9d4\",\"lessThan\":\"284c267f013e45d8c89d9fb9373105dc8e6c0947\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"307bececcd1205bcb67a3c0d53a69db237ccc9d4\",\"lessThan\":\"65476d31d8056e859c48580f82295ce159196ffe\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/shrinker.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-25T15:59:43Z",
      "cve": "CVE-2026-64418",
      "id": "CVE-2026-64418",
      "initial_release_date": "2026-07-25T15:59:43Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64418",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64418.json",
      "version": "2"
    }
  }
}

GHSA-Q5WG-G4G8-XFHC

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31

Details

In the Linux kernel, the following vulnerability has been resolved:

mm: shrinker: fix shrinker_info teardown race with expansion

expand_shrinker_info() iterates all visible memcgs under shrinker_mutex, including memcgs that have not finished ->css_online() yet.

Once pn->shrinker_info has been published, teardown must stay serialized with expand_shrinker_info() until that memcg is either fully online or no longer visible to iteration. Today alloc_shrinker_info() breaks that rule by dropping shrinker_mutex before freeing a partially initialized shrinker_info array, which may cause the following race:

CPU0 CPU1 ==== ====

css_create --> list_add_tail_rcu(&css->sibling, &parent_css->children); online_css --> mem_cgroup_css_online --> alloc_shrinker_info --> alloc node0 info rcu_assign_pointer(C->node0->shrinker_info, old0) alloc node1 info -> FAIL -> goto err mutex_unlock(shrinker_mutex)

                   shrinker_alloc()
                   --> shrinker_memcg_alloc
                       --> mutex_lock(shrinker_mutex)
                           expand_shrinker_info
                           --> mem_cgroup_iter see the memcg
                               expand_one_shrinker_info
                               --> old0 = C->node0->shrinker_info
                                   memcpy(new->unit, old0->unit, ...);

            free_shrinker_info
            --> kvfree(old0);

                                   /* double free !! */
                                   kvfree_rcu(old0, rcu);

The same problem exists later in mem_cgroup_css_online(). If alloc_shrinker_info() succeeds but a subsequent objcg allocation fails, the free_objcg -> free_shrinker_info() unwind path tears down the already published pn->shrinker_info arrays without shrinker_mutex. The expand_one_shrinker_info() can race with that teardown in the same way, leading to use-after-free or double-free of the old shrinker_info.

Fix this by serializing shrinker_info teardown with shrinker_mutex, and by keeping alloc_shrinker_info() error cleanup inside the locked section.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64418"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:25Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix shrinker_info teardown race with expansion\n\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\nincluding memcgs that have not finished -\u003ecss_online() yet.\n\nOnce pn-\u003eshrinker_info has been published, teardown must stay serialized\nwith expand_shrinker_info() until that memcg is either fully online or no\nlonger visible to iteration.  Today alloc_shrinker_info() breaks that rule\nby dropping shrinker_mutex before freeing a partially initialized\nshrinker_info array, which may cause the following race:\n\nCPU0                   CPU1\n====                   ====\n\ncss_create\n--\u003e list_add_tail_rcu(\u0026css-\u003esibling, \u0026parent_css-\u003echildren);\n    online_css\n    --\u003e mem_cgroup_css_online\n        --\u003e alloc_shrinker_info\n            --\u003e alloc node0 info\n                rcu_assign_pointer(C-\u003enode0-\u003eshrinker_info, old0)\n                alloc node1 info -\u003e FAIL -\u003e goto err\n                mutex_unlock(shrinker_mutex)\n\n                       shrinker_alloc()\n                       --\u003e shrinker_memcg_alloc\n                           --\u003e mutex_lock(shrinker_mutex)\n                               expand_shrinker_info\n                               --\u003e mem_cgroup_iter see the memcg\n                                   expand_one_shrinker_info\n                                   --\u003e old0 = C-\u003enode0-\u003eshrinker_info\n                                       memcpy(new-\u003eunit, old0-\u003eunit, ...);\n\n                free_shrinker_info\n                --\u003e kvfree(old0);\n\n                                       /* double free !! */\n                                       kvfree_rcu(old0, rcu);\n\nThe same problem exists later in mem_cgroup_css_online().  If\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\nthe free_objcg -\u003e free_shrinker_info() unwind path tears down the already\npublished pn-\u003eshrinker_info arrays without shrinker_mutex.  The\nexpand_one_shrinker_info() can race with that teardown in the same way,\nleading to use-after-free or double-free of the old shrinker_info.\n\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\nkeeping alloc_shrinker_info() error cleanup inside the locked section.",
  "id": "GHSA-q5wg-g4g8-xfhc",
  "modified": "2026-07-25T12:31:34Z",
  "published": "2026-07-25T12:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64418"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-64418 (GCVE-0-2026-64418)

GHSA-Q5WG-G4G8-XFHC

Tags

Sightings

Nomenclature