# CVE-2026-64417: linux: In the Linux kernel, the following vulnerability has been resolved:  mm: shrinker: fix NULL pointer dereference in de...

CVE-2026-64417 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-64417, released July 26, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-64417
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0012
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 25, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  mm: shrinker: fix NULL pointer dereference in debugfs  shrinker_debugfs_add() creates both "count" and "scan" debugfs files unconditionally.  That assumes every shrinker implements both count_objects() and scan_objects(), which is not guaranteed.  For example, the xen-backend shrinker sets count_objects() but leaves scan_objects() NULL, so writing to its scan file calls through a NULL function pointer and panics the kernel:  BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. Call Trace:  <TASK>  shrinker_debugfs_scan_write+0x12e/0x270  full_proxy_write+0x5f/0x90  vfs_write+0xde/0x420  ? filp_flush+0x75/0x90  ? filp_close+0x1d/0x30  ? do_dup2+0xb8/0x120  ksys_write+0x68/0xf0  ? filp_flush+0x75/0x90  do_syscall_64+0xb3/0x5b0  entry_SYSCALL_64_after_hwframe+0x76/0x7e  The count path has the same issue in principle if a shrinker omits count_objects().  To fix it, only create "count" and "scan" debugfs files when the corresponding callbacks are present.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.180-1 | [DEBIAN-CVE-2026-64417](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64417.md) | Jul 26, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.96-1 | [DEBIAN-CVE-2026-64417](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64417.md) | Jul 26, 2026 |
| Linux | linux Debian 14 | 7.1.4-1 | [DEBIAN-CVE-2026-64417](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64417.md) | Jul 26, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.100-1~deb12u1 | [DEBIAN-CVE-2026-64417](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64417.md) | Jul 26, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.