Linux mm: NULL dereference in lookup_swap_cgroup_id panics swapless hosts at process exit

Impact

lookup_swap_cgroup_id() dereferences swap_cgroup_ctrl[type].map without checking that the swap type was ever registered. On a host with no swap configured every map is NULL, so a single PTE corrupted into a type-0 swap entry turns process teardown into a fatal page fault at an attacker-independent moment. This matters more than most mm hardening patches because GPU and Kubernetes nodes are almost universally swapless, which is exactly the configuration that has no guard here, and the report is from production on 6.12.58 rather than a fuzzer alone. The panic lands in exit_mmap(), so the node dies rather than the job. The commit hardens the teardown path the way the fault path already was; the underlying source of PTE corruption is a separate unfixed bug.

Who can reach it

Local. Reached at process exit, not directly invoked by an attacker, and it requires a corrupted PTE to already exist, so treat this as reliability hardening on swapless nodes rather than a directly exploitable path.

What to do

Update to a stable kernel carrying the fix and reboot each node. The kernel CNA lists four stable commits and no fixed version string; match the commits below to the branch you run. There is no runtime mitigation, since the trigger is ordinary process exit.

References

Related entries

• Linux io_uring: NOP with IOSQE_FIXED_FILE leaks a struct file reference on every submissionCVE-2026-64426 · Linux kernel io_uring NOP opcode (IOSQE_FIXED_FILE handling)Medium
• Linux kernel (drivers/vfio/pci): The disable_idle_d3 power-management flag was a module-wide global that could changeCVE-2026-64476 · Linux kernel (drivers/vfio/pci)Medium
• Linux kernel (drivers/iommu/intel): SVA bind and unbind are asymmetric on VT-d hardware without PCI/PRI - bind skipsCVE-2026-64591 · Linux kernel (drivers/iommu/intel)Medium
• Linux kernel (arch/x86/kvm/vmx): When a nested VM-Enter fails on invalid guest state, KVM took an open-coded exit pathCVE-2026-68081 · Linux kernel (arch/x86/kvm/vmx)Medium
• AMD SEV-ES (CacheWarp): CacheWarp: INVD lets a malicious hypervisor revert SEV-ES guest memory writes, breaking guestCVE-2023-20592 · AMD SEV-ES (CacheWarp)Medium
• Linux kernel (drivers/pci): When the kernel coalesces two adjacent host-bridge apertures it invalidates the absorbedCVE-2023-53814 · Linux kernel (drivers/pci)Medium