CVE-2026-64416

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.58

Description A NULL pointer dereference occurs in the lookup swap cgroup id() function on hosts without swap enabled. The function passes swap cgroup ctrl[type].map to swap cgroup id lookup() without verifying if the type was registered via swap cgroup swapon(). On swapless hosts, this map is NULL, leading to a crash when swap cgroup id lookup() attempts to dereference it. This issue is triggered when zap pte range() calls swap pte batch(), which then invokes lookup swap cgroup id() for a non-present, non-none Page Table Entry (PTE) that decodes as a swap entry without prior validation against swap info[]. A corrupted PTE can cause the host to crash during process exit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.