GHSA-H85J-5G9P-PPJ5
Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31In the Linux kernel, the following vulnerability has been resolved:
mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section:
BUG: sleeping function called from invalid context at kernel/cgroup/rstat.c:421 RCU nest depth: 1, expected: 0 css_rstat_flush mem_cgroup_flush_stats zswap_shrinker_count shrinker_debugfs_count_show
shrinker_debugfs_count_show() invokes the ->count_objects() callback under rcu_read_lock(). The zswap callback flushes memcg stats via css_rstat_flush(), which may sleep, so it must not run under RCU.
The RCU lock is not needed here. mem_cgroup_iter() takes RCU internally and returns a memcg holding a css reference (dropped on the next iteration or by mem_cgroup_iter_break()), so the memcg stays alive without it. The shrinker is kept alive by the open debugfs file: shrinker_free() removes the debugfs entries via debugfs_remove_recursive(), which waits for in-flight readers to drain, before call_rcu(..., shrinker_free_rcu_cb). The sibling "scan" handler already invokes the sleeping ->scan_objects() callback with no RCU section.
Drop the rcu_read_lock()/rcu_read_unlock().
{
"affected": [],
"aliases": [
"CVE-2026-64419"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-25T10:17:25Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()\n\nReading the debugfs \"count\" file of a memcg-aware shrinker can sleep\ninside an RCU read-side critical section:\n\n BUG: sleeping function called from invalid context at kernel/cgroup/rstat.c:421\n RCU nest depth: 1, expected: 0\n css_rstat_flush\n mem_cgroup_flush_stats\n zswap_shrinker_count\n shrinker_debugfs_count_show\n\nshrinker_debugfs_count_show() invokes the -\u003ecount_objects() callback under\nrcu_read_lock(). The zswap callback flushes memcg stats via\ncss_rstat_flush(), which may sleep, so it must not run under RCU.\n\nThe RCU lock is not needed here. mem_cgroup_iter() takes RCU internally\nand returns a memcg holding a css reference (dropped on the next iteration\nor by mem_cgroup_iter_break()), so the memcg stays alive without it. The\nshrinker is kept alive by the open debugfs file: shrinker_free() removes\nthe debugfs entries via debugfs_remove_recursive(), which waits for\nin-flight readers to drain, before call_rcu(..., shrinker_free_rcu_cb). \nThe sibling \"scan\" handler already invokes the sleeping -\u003escan_objects()\ncallback with no RCU section.\n\nDrop the rcu_read_lock()/rcu_read_unlock().",
"id": "GHSA-h85j-5g9p-ppj5",
"modified": "2026-07-25T12:31:35Z",
"published": "2026-07-25T12:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64419"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2fed79f0fe8c8d28a972c290dbfd693c3546c8c4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/560e21e8ccff813e84d05f6500907c549a3d6985"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/86237e56091e70f09c0fbf217f9d9c0e08f556c4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b902890c62d200b3509cb5e09cf1e0a66553c128"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/de5f69b8dae8698ac5e48dfcd30017887cdf4e5a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e441cbfbd0eaa6404278e985033c33caba4db767"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.