What is CVE-2026-64417?

CVE-2026-64417 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, classified as a NULL Pointer Dereference flaw (CWE-476), affecting Linux kernel versions from 6.0 onward and patched in 6.1.178, 6.6.145, 6.12.96 and others. CVE-2026-64417 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-64417?

CVE-2026-64417 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-64417?

Yes, CVE-2026-64417 has been patched. Fixed versions include 6.1.178, 6.6.145, 6.12.96 and others. If you are running Linux kernel 6.0 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-64417 actively exploited?

CVE-2026-64417 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is NULL Pointer Dereference (CWE-476)?

The product dereferences a pointer that it expects to be valid but is NULL, typically causing a crash. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/476.html

CVE-2026-64417

Medium

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinker_debugfs_add() creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both count_objects() and scan_objects(), which is not guaranteed. For example, the xen-backend shrinker sets count_objects() but leaves scan_objects() NULL, so writing to its scan file calls through a NULL function pointer and panics the kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. Call Trace: <TASK> shrinker_debugfs_scan_write+0x12e/0x270 full_proxy_write+0x5f/0x90 vfs_write+0xde/0x420 ? filp_flush+0x75/0x90 ? filp_close+0x1d/0x30 ? do_dup2+0xb8/0x120 ksys_write+0x68/0xf0 ? filp_flush+0x75/0x90 do_syscall_64+0xb3/0x5b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The count path has the same issue in principle if a shrinker omits count_objects(). To fix it, only create "count" and "scan" debugfs files when the corresponding callbacks are present.

Package Linux Kernel

Published 2026-07-25

Last modified 2026-09-04

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-476

CVE-2026-64417 is a NULL Pointer Dereference vulnerability

What is NULL Pointer Dereference?

The product dereferences a pointer that it expects to be valid but is NULL, typically causing a crash. Learn more on MITRE CWE

Affected versions

Linux kernel versions 6.0 and later are affected. Fixed in 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2 and their respective stable series.

Affected from

≥ 6.0

Fixed in

✓ 6.1.178 6.1.x ✓ 6.6.145 6.6.x ✓ 6.12.96 6.12.x ✓ 6.18.39 6.18.x ✓ 7.1.4 7.1.x ✓ 7.2

References

6 total

Kernel Git
https://git.kernel.org/stable/c/006467ab932698612398f853344a7405164541f4

Patch
Kernel Git
https://git.kernel.org/stable/c/09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9

Patch
Kernel Git
https://git.kernel.org/stable/c/36f8534f461222291a74156ab91f3ba9f09b6f93

Patch
Kernel Git
https://git.kernel.org/stable/c/b9beed2322f3538b0d2d53307062da4102b8d8d8

Patch
Kernel Git
https://git.kernel.org/stable/c/e30453c61e185e914fde83c650e268067b140218

Patch

Showing 5 of 6 references View all on NVD

Details

CVE ID CVE-2026-64417

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-07-25

Modified 2026-09-04

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-64417?

CVE-2026-64417 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as a NULL Pointer Dereference flaw (CWE-476) . It affects Linux kernel versions from 6.0 onward and has been patched in 6.1.178, 6.6.145, 6.12.96 and others. CVE-2026-64417 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-64417?

CVE-2026-64417 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-64417?

Yes. CVE-2026-64417 has been patched. Fixed versions include 6.1.178, 6.6.145, 6.12.96 and others. If you are running Linux kernel 6.0 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-64417 actively exploited?

No. CVE-2026-64417 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.