CVE-2026-64418 (GCVE-0-2026-64418)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:55
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race with expansion expand_shrinker_info() iterates all visible memcgs under shrinker_mutex, including memcgs that have not finished ->css_online() yet. Once pn->shrinker_info has been published, teardown must stay serialized with expand_shrinker_info() until that memcg is either fully online or no longer visible to iteration. Today alloc_shrinker_info() breaks that rule by dropping shrinker_mutex before freeing a partially initialized shrinker_info array, which may cause the following race: CPU0 CPU1 ==== ==== css_create --> list_add_tail_rcu(&css->sibling, &parent_css->children); online_css --> mem_cgroup_css_online --> alloc_shrinker_info --> alloc node0 info rcu_assign_pointer(C->node0->shrinker_info, old0) alloc node1 info -> FAIL -> goto err mutex_unlock(shrinker_mutex) shrinker_alloc() --> shrinker_memcg_alloc --> mutex_lock(shrinker_mutex) expand_shrinker_info --> mem_cgroup_iter see the memcg expand_one_shrinker_info --> old0 = C->node0->shrinker_info memcpy(new->unit, old0->unit, ...); free_shrinker_info --> kvfree(old0); /* double free !! */ kvfree_rcu(old0, rcu); The same problem exists later in mem_cgroup_css_online(). If alloc_shrinker_info() succeeds but a subsequent objcg allocation fails, the free_objcg -> free_shrinker_info() unwind path tears down the already published pn->shrinker_info arrays without shrinker_mutex. The expand_one_shrinker_info() can race with that teardown in the same way, leading to use-after-free or double-free of the old shrinker_info. Fix this by serializing shrinker_info teardown with shrinker_mutex, and by keeping alloc_shrinker_info() error cleanup inside the locked section.
References
Impacted products
Vendor Product Version
Linux Linux Version: 307bececcd1205bcb67a3c0d53a69db237ccc9d4
Version: 307bececcd1205bcb67a3c0d53a69db237ccc9d4
Version: 307bececcd1205bcb67a3c0d53a69db237ccc9d4
Version: 307bececcd1205bcb67a3c0d53a69db237ccc9d4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b9a280a9a454ed514636351d53fe2a233dc5054b",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "6465ff3ce65131c774a312d450abe10f4b9f3875",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "284c267f013e45d8c89d9fb9373105dc8e6c0947",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "65476d31d8056e859c48580f82295ce159196ffe",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix shrinker_info teardown race with expansion\n\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\nincluding memcgs that have not finished -\u003ecss_online() yet.\n\nOnce pn-\u003eshrinker_info has been published, teardown must stay serialized\nwith expand_shrinker_info() until that memcg is either fully online or no\nlonger visible to iteration.  Today alloc_shrinker_info() breaks that rule\nby dropping shrinker_mutex before freeing a partially initialized\nshrinker_info array, which may cause the following race:\n\nCPU0                   CPU1\n====                   ====\n\ncss_create\n--\u003e list_add_tail_rcu(\u0026css-\u003esibling, \u0026parent_css-\u003echildren);\n    online_css\n    --\u003e mem_cgroup_css_online\n        --\u003e alloc_shrinker_info\n            --\u003e alloc node0 info\n                rcu_assign_pointer(C-\u003enode0-\u003eshrinker_info, old0)\n                alloc node1 info -\u003e FAIL -\u003e goto err\n                mutex_unlock(shrinker_mutex)\n\n                       shrinker_alloc()\n                       --\u003e shrinker_memcg_alloc\n                           --\u003e mutex_lock(shrinker_mutex)\n                               expand_shrinker_info\n                               --\u003e mem_cgroup_iter see the memcg\n                                   expand_one_shrinker_info\n                                   --\u003e old0 = C-\u003enode0-\u003eshrinker_info\n                                       memcpy(new-\u003eunit, old0-\u003eunit, ...);\n\n                free_shrinker_info\n                --\u003e kvfree(old0);\n\n                                       /* double free !! */\n                                       kvfree_rcu(old0, rcu);\n\nThe same problem exists later in mem_cgroup_css_online().  If\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\nthe free_objcg -\u003e free_shrinker_info() unwind path tears down the already\npublished pn-\u003eshrinker_info arrays without shrinker_mutex.  The\nexpand_one_shrinker_info() can race with that teardown in the same way,\nleading to use-after-free or double-free of the old shrinker_info.\n\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\nkeeping alloc_shrinker_info() error cleanup inside the locked section."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reachable through local cgroup mkdir operations raced against memcg-aware shrinker allocation, such as mounting new tmpfs instances.\nAC:L - An attacker can repeatedly create cgroups, induce allocation pressure, and concurrently allocate shrinkers, controlling both sides of the race and widening it through repetition.\nPR:L - An unprivileged user with a delegated cgroup v2 subtree can create memory cgroups, while user namespaces provide the capability needed to mount user-namespace-enabled filesystems.\nUI:N - Exploitation requires no action by another user once the attacker can execute the concurrent local operations.\nS:U - The corruption occurs within the kernel and represents ordinary local privilege escalation within the same security authority.\nC:H - The use-after-free and delayed double-free permit heap reuse and manipulation of dangling shrinker unit pointers, potentially enabling arbitrary kernel-memory disclosure.\nI:H - The dangling pointers, atomic operations on freed units, and double-free can provide arbitrary kernel-memory corruption and control-flow hijacking.\nA:H - The use-after-free or double-free can directly cause a kernel oops, panic, or other system-wide failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:17.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875"
        },
        {
          "url": "https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947"
        },
        {
          "url": "https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe"
        }
      ],
      "title": "mm: shrinker: fix shrinker_info teardown race with expansion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64418",
    "datePublished": "2026-07-25T08:50:57.594Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-17T04:55:17.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.