In the Linux kernel, the following vulnerability has been resolved: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host… (CVE-2026-64416)
A NULL pointer dereference vulnerability in the Linux kernel's memory management subsystem was fixed. The issue occurs in the function lookup_swap_cgroup_id() when called on a swapless host, leading to a NULL dereference and kernel crash. This can cause a system crash during process exit if a corrupted page table entry (PTE) is encountered. The vulnerability was identified in Linux kernel version 6.12.58 and involves improper validation of swap entries in page table teardown paths.
AI Analysis
Technical Summary
The Linux kernel contained a vulnerability in the mm subsystem where lookup_swap_cgroup_id() did not verify that a swap type was registered before dereferencing a pointer. On swapless hosts, this led to a NULL pointer dereference in __swap_cgroup_id_lookup() due to passing a NULL map pointer. Since commit bea67dcc5eea, zap_pte_range() calls lookup_swap_cgroup_id() on certain PTEs without validating them against swap_info[], causing a kernel crash if a corrupted PTE is interpreted as a type-0 swap entry. This vulnerability causes a BUG and kernel panic during process exit. The fix improves robustness by adding necessary checks to prevent NULL dereference in the teardown path.
Potential Impact
A corrupted page table entry on a swapless Linux host can trigger a NULL pointer dereference in the kernel, causing a system crash (kernel panic) during process exit. This affects system stability and availability but does not indicate code execution or privilege escalation from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running affected kernel versions on swapless hosts or apply any vendor-provided workarounds. Monitor vendor channels for updates and apply patches promptly once released.
In the Linux kernel, the following vulnerability has been resolved: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host… (CVE-2026-64416)
Description
A NULL pointer dereference vulnerability in the Linux kernel's memory management subsystem was fixed. The issue occurs in the function lookup_swap_cgroup_id() when called on a swapless host, leading to a NULL dereference and kernel crash. This can cause a system crash during process exit if a corrupted page table entry (PTE) is encountered. The vulnerability was identified in Linux kernel version 6.12.58 and involves improper validation of swap entries in page table teardown paths.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel contained a vulnerability in the mm subsystem where lookup_swap_cgroup_id() did not verify that a swap type was registered before dereferencing a pointer. On swapless hosts, this led to a NULL pointer dereference in __swap_cgroup_id_lookup() due to passing a NULL map pointer. Since commit bea67dcc5eea, zap_pte_range() calls lookup_swap_cgroup_id() on certain PTEs without validating them against swap_info[], causing a kernel crash if a corrupted PTE is interpreted as a type-0 swap entry. This vulnerability causes a BUG and kernel panic during process exit. The fix improves robustness by adding necessary checks to prevent NULL dereference in the teardown path.
Potential Impact
A corrupted page table entry on a swapless Linux host can trigger a NULL pointer dereference in the kernel, causing a system crash (kernel panic) during process exit. This affects system stability and availability but does not indicate code execution or privilege escalation from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running affected kernel versions on swapless hosts or apply any vendor-provided workarounds. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fp4w-89fw-h8p4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64416"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420a9c2644c7f8084151
Added to database: 07/25/2026, 23:08:58 UTC
Last enriched: 07/25/2026, 23:26:30 UTC
Last updated: 07/26/2026, 03:58:56 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.