180 lines
11 KiB
JSON
180 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-64418",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-19T15:36:31.786Z",
|
|
"datePublished": "2026-07-25T08:50:57.594Z",
|
|
"dateUpdated": "2026-08-17T04:55:17.788Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-17T04:55:17.788Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix shrinker_info teardown race with expansion\n\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\nincluding memcgs that have not finished ->css_online() yet.\n\nOnce pn->shrinker_info has been published, teardown must stay serialized\nwith expand_shrinker_info() until that memcg is either fully online or no\nlonger visible to iteration. Today alloc_shrinker_info() breaks that rule\nby dropping shrinker_mutex before freeing a partially initialized\nshrinker_info array, which may cause the following race:\n\nCPU0 CPU1\n==== ====\n\ncss_create\n--> list_add_tail_rcu(&css->sibling, &parent_css->children);\n online_css\n --> mem_cgroup_css_online\n --> alloc_shrinker_info\n --> alloc node0 info\n rcu_assign_pointer(C->node0->shrinker_info, old0)\n alloc node1 info -> FAIL -> goto err\n mutex_unlock(shrinker_mutex)\n\n shrinker_alloc()\n --> shrinker_memcg_alloc\n --> mutex_lock(shrinker_mutex)\n expand_shrinker_info\n --> mem_cgroup_iter see the memcg\n expand_one_shrinker_info\n --> old0 = C->node0->shrinker_info\n memcpy(new->unit, old0->unit, ...);\n\n free_shrinker_info\n --> kvfree(old0);\n\n /* double free !! */\n kvfree_rcu(old0, rcu);\n\nThe same problem exists later in mem_cgroup_css_online(). If\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\nthe free_objcg -> free_shrinker_info() unwind path tears down the already\npublished pn->shrinker_info arrays without shrinker_mutex. The\nexpand_one_shrinker_info() can race with that teardown in the same way,\nleading to use-after-free or double-free of the old shrinker_info.\n\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\nkeeping alloc_shrinker_info() error cleanup inside the locked section."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable path is reachable through local cgroup mkdir operations raced against memcg-aware shrinker allocation, such as mounting new tmpfs instances.\nAC:L - An attacker can repeatedly create cgroups, induce allocation pressure, and concurrently allocate shrinkers, controlling both sides of the race and widening it through repetition.\nPR:L - An unprivileged user with a delegated cgroup v2 subtree can create memory cgroups, while user namespaces provide the capability needed to mount user-namespace-enabled filesystems.\nUI:N - Exploitation requires no action by another user once the attacker can execute the concurrent local operations.\nS:U - The corruption occurs within the kernel and represents ordinary local privilege escalation within the same security authority.\nC:H - The use-after-free and delayed double-free permit heap reuse and manipulation of dangling shrinker unit pointers, potentially enabling arbitrary kernel-memory disclosure.\nI:H - The dangling pointers, atomic operations on freed units, and double-free can provide arbitrary kernel-memory corruption and control-flow hijacking.\nA:H - The use-after-free or double-free can directly cause a kernel oops, panic, or other system-wide failure."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/shrinker.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
|
|
"lessThan": "b9a280a9a454ed514636351d53fe2a233dc5054b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
|
|
"lessThan": "6465ff3ce65131c774a312d450abe10f4b9f3875",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
|
|
"lessThan": "284c267f013e45d8c89d9fb9373105dc8e6c0947",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
|
|
"lessThan": "65476d31d8056e859c48580f82295ce159196ffe",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/shrinker.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.7",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.7",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.96",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.39",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.4",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.7",
|
|
"versionEndExcluding": "6.12.96"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.7",
|
|
"versionEndExcluding": "6.18.39"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.7",
|
|
"versionEndExcluding": "7.1.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.7",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe"
|
|
}
|
|
],
|
|
"title": "mm: shrinker: fix shrinker_info teardown race with expansion",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |