{"schema_version":"1.9.0","id":"CVE-2026-64418","published":"2026-07-25T08:50:57.594Z","modified":"2026-09-06T03:30:49.405070983Z","related":["ALSA-2026:61887","openSUSE-SU-2026:11476-1"],"summary":"mm: shrinker: fix shrinker_info teardown race with expansion","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix shrinker_info teardown race with expansion\n\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\nincluding memcgs that have not finished ->css_online() yet.\n\nOnce pn->shrinker_info has been published, teardown must stay serialized\nwith expand_shrinker_info() until that memcg is either fully online or no\nlonger visible to iteration.  Today alloc_shrinker_info() breaks that rule\nby dropping shrinker_mutex before freeing a partially initialized\nshrinker_info array, which may cause the following race:\n\nCPU0                   CPU1\n====                   ====\n\ncss_create\n--> list_add_tail_rcu(&css->sibling, &parent_css->children);\n    online_css\n    --> mem_cgroup_css_online\n        --> alloc_shrinker_info\n            --> alloc node0 info\n                rcu_assign_pointer(C->node0->shrinker_info, old0)\n                alloc node1 info -> FAIL -> goto err\n                mutex_unlock(shrinker_mutex)\n\n                       shrinker_alloc()\n                       --> shrinker_memcg_alloc\n                           --> mutex_lock(shrinker_mutex)\n                               expand_shrinker_info\n                               --> mem_cgroup_iter see the memcg\n                                   expand_one_shrinker_info\n                                   --> old0 = C->node0->shrinker_info\n                                       memcpy(new->unit, old0->unit, ...);\n\n                free_shrinker_info\n                --> kvfree(old0);\n\n                                       /* double free !! */\n                                       kvfree_rcu(old0, rcu);\n\nThe same problem exists later in mem_cgroup_css_online().  If\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\nthe free_objcg -> free_shrinker_info() unwind path tears down the already\npublished pn->shrinker_info arrays without shrinker_mutex.  The\nexpand_one_shrinker_info() can race with that teardown in the same way,\nleading to use-after-free or double-free of the old shrinker_info.\n\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\nkeeping alloc_shrinker_info() error cleanup inside the locked section.","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"307bececcd1205bcb67a3c0d53a69db237ccc9d4"},{"fixed":"b9a280a9a454ed514636351d53fe2a233dc5054b"},{"fixed":"6465ff3ce65131c774a312d450abe10f4b9f3875"},{"fixed":"284c267f013e45d8c89d9fb9373105dc8e6c0947"},{"fixed":"65476d31d8056e859c48580f82295ce159196ffe"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64418.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.96"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64418.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875"},{"type":"WEB","url":"https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64418.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64418"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64418.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}