Skip to main content

Linux Kernel EUVDEUVD-2026-48960

| CVE-2026-64416 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-25 Linux GHSA-fp4w-89fw-h8p4
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local process exit triggers crash; low-privilege user sufficient; no confidentiality or integrity impact, only availability loss via kernel panic.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 16:08 vuln.today
CVSS changed
Sep 04, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host

lookup_swap_cgroup_id() passes swap_cgroup_ctrl[type].map to __swap_cgroup_id_lookup() without checking that the type was ever registered via swap_cgroup_swapon(). On a swapless host every ctrl->map is NULL, so __swap_cgroup_id_lookup() dereferences NULL + a scaled swp_offset().

Since commit bea67dcc5eea ("mm: attempt to batch free swap entries for zap_pte_range()"), zap_pte_range() -> swap_pte_batch() calls lookup_swap_cgroup_id() on any non-present, non-none PTE that decodes as a real swap entry, without first validating it against swap_info[]. A single PTE corrupted into a type-0 swap entry takes the host down at process exit.

We hit this in production on a swapless 6.12.58 host: ~1s of "get_swap_device: Bad swap file entry 3f800204222bb" (do_swap_page() being correctly defensive about the same entry) followed by

BUG: unable to handle page fault for address: 000003f800204220 RIP: 0010:lookup_swap_cgroup_id+0x2b/0x60 Call Trace: swap_pte_batch+0xbf/0x230 zap_pte_range+0x4c8/0x780 unmap_page_range+0x190/0x3e0 exit_mmap+0xd9/0x3c0 do_exit+0x20c/0x4b0

syzbot has reported the identical stack.

The source of the PTE corruption is a separate bug; this change makes the teardown path as robust as the fault path already is. Every other caller of lookup_swap_cgroup_id() is downstream of a get_swap_device() that has already validated the entry, so the new branch is cold.

AnalysisAI

NULL pointer dereference in the Linux kernel's swap cgroup subsystem (mm/swap_cgroup.c) causes a kernel panic and full system crash on swapless hosts running kernel versions after commit bea67dcc5eea. The batched PTE zap path introduced by that commit calls lookup_swap_cgroup_id() without validating the swap entry against swap_info[], so any process exit involving a PTE corrupted into a type-0 swap entry dereferences the uninitialized ctrl->map pointer and takes the host down. The crash pattern was confirmed in production on kernel 6.12.58 and independently reproduced by syzbot; no public exploit exists, but the kernel teardown path is deterministically vulnerable once the prerequisite conditions are present.

Technical ContextAI

The vulnerability resides in mm/swap_cgroup.c. The Linux kernel memory controller tracks per-cgroup swap usage through a per-swap-type map (swap_cgroup_ctrl[type].map) that is only allocated when swap is activated via swap_cgroup_swapon(). On hosts with no swap configured, every ctrl->map remains NULL. CWE-476 (NULL Pointer Dereference) describes the root cause: lookup_swap_cgroup_id() passes ctrl->map directly to __swap_cgroup_id_lookup() without a NULL guard. The regression was introduced by commit bea67dcc5eea ('mm: attempt to batch free swap entries for zap_pte_range()'), which added a batched PTE teardown path in zap_pte_range() → swap_pte_batch() that bypasses the get_swap_device() validation every other caller relies on to confirm entry legitimacy before accessing cgroup metadata. Affected CPE: cpe:2.3:a:linux:linux:*, spanning stable series 6.12 and 6.18 and development branches 7.1 and 7.2-rc1.

RemediationAI

Upgrade to a patched stable kernel release: 6.12.97 or later, 6.18.39 or later, 7.1.4 or later, or 7.2-rc1 or later. The four upstream fix commits are available at https://git.kernel.org/stable/c/818416fef38759f23210de449663cd9d7e293d39, https://git.kernel.org/stable/c/b415c00bf23df577a4a95673d00ae76687bcc1d4, https://git.kernel.org/stable/c/6a4196d19f477524d2f92adca90fc1fbe9a0420a, and https://git.kernel.org/stable/c/63b02a9409cb5180398491b093e48bcb5315f5fb. As a temporary workaround on systems where an immediate kernel upgrade is not feasible, enabling a small swap device (e.g., a swap file of even 64 MiB) causes swap_cgroup_swapon() to allocate the map and prevents the NULL dereference; this introduces minor swap I/O overhead but eliminates the crash vector. Restricting use of experimental kernel memory-management modules or untrusted kernel code paths that could corrupt PTEs is prudent but not a stand-alone mitigation since PTE corruption sources are independent.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-48960 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy