In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Reading the… (CVE-2026-64419)
A vulnerability in the Linux kernel's memory control group (memcg) shrinker debugfs interface was resolved. The issue involved holding an RCU read lock while calling a callback that may sleep, which is invalid and can cause kernel bugs. The fix removes the unnecessary RCU lock to prevent sleeping in an RCU critical section.
AI Analysis
Technical Summary
The Linux kernel contained a vulnerability where the function shrinker_debugfs_count_show() held an RCU read lock while invoking the ->count_objects() callback. This callback, specifically the zswap implementation, could sleep by flushing memcg stats, which is not allowed inside an RCU read-side critical section. This misuse could lead to kernel bugs such as 'BUG: sleeping function called from invalid context'. The fix removes the rcu_read_lock()/rcu_read_unlock() calls since the memcg iterator internally manages RCU and reference counting, making the external RCU lock unnecessary.
Potential Impact
The vulnerability could cause kernel bugs or crashes due to sleeping in an invalid context within the RCU read-side critical section. This may affect system stability but no direct exploit or privilege escalation is indicated in the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates it has been resolved, implying a fix is available. Users should apply the official Linux kernel updates that address this issue once released.
In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Reading the… (CVE-2026-64419)
Description
A vulnerability in the Linux kernel's memory control group (memcg) shrinker debugfs interface was resolved. The issue involved holding an RCU read lock while calling a callback that may sleep, which is invalid and can cause kernel bugs. The fix removes the unnecessary RCU lock to prevent sleeping in an RCU critical section.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel contained a vulnerability where the function shrinker_debugfs_count_show() held an RCU read lock while invoking the ->count_objects() callback. This callback, specifically the zswap implementation, could sleep by flushing memcg stats, which is not allowed inside an RCU read-side critical section. This misuse could lead to kernel bugs such as 'BUG: sleeping function called from invalid context'. The fix removes the rcu_read_lock()/rcu_read_unlock() calls since the memcg iterator internally manages RCU and reference counting, making the external RCU lock unnecessary.
Potential Impact
The vulnerability could cause kernel bugs or crashes due to sleeping in an invalid context within the RCU read-side critical section. This may affect system stability but no direct exploit or privilege escalation is indicated in the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates it has been resolved, implying a fix is available. Users should apply the official Linux kernel updates that address this issue once released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h85j-5g9p-ppj5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64419"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542099c2644c7f80835d8
Added to database: 07/25/2026, 23:08:57 UTC
Last enriched: 07/25/2026, 23:23:33 UTC
Last updated: 07/26/2026, 03:56:11 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.