The Linux kernel's shrinker_debugfs_add() function creates debugfs files "count" and "scan" without verifying that the shrinker implements the corresponding count_objects() and scan_objects() callbacks. If a shrinker omits either callback, such as the xen-backend shrinker which sets count_objects() but leaves scan_objects() NULL, writing to the "scan" debugfs file triggers a NULL pointer dereference and kernel panic. The fix involves conditional creation of these debugfs files only when the associated callbacks are implemented.

Exploitation of this vulnerability can cause a kernel panic due to a NULL pointer dereference, resulting in a denial of service condition on affected systems. There is no indication of privilege escalation or code execution. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to address this issue by conditionally creating debugfs files only when the corresponding callbacks exist. Users should apply the official kernel update that includes this fix once available. Patch status is not yet confirmed from vendor advisories; check the Linux kernel mailing lists or vendor advisories for the official patch and update guidance.