In the Linux kernel, the following vulnerability has been resolved:
mm: zswap: fix shrinker NULL crash with cgroup_disable=memory
Christian reports a NULL deref in zswap that he bisected down to the zswap shrinker. The issue also cropped up in the bug trackers of libguestfs [1] and the Red Hat bugzilla [2].
The problem is that when memcg is disabled with the boot time flag, the zswap shrinker might get called with sc->memcg == NULL. This is okay in many places, like the lruvec operations. But it crashes in memcg_page_state() - which is only used due to the non-node accounting of cgroup's the zswap memory to begin with.
Nhat spotted that the memcg can be NULL in the memcg-disabled case, and I was then able to reproduce the crash locally as well.
[1] https://github.com/libguestfs/libguestfs/issues/139 [2] https://bugzilla.redhat.com/show_bug.cgi?id=2275252
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 17, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-lowlatencyUpgrade linux-image-nvidiaUpgrade linux-image-awsUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1012-azureUpgrade linux-image-generic-lpaeUpgrade linux-image-oracleUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1010-oemUpgrade linux-image-nvidia-64kUpgrade linux-image-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-generic-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-genericUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-azureUpgrade linux-image-kvmUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64k | Aug 9, 2024 | May 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub