CVE-2026-23195: cgroup/dmem: avoid pool UAF
In the Linux kernel, the following vulnerability has been resolved:
cgroup/dmem: avoid pool UAF
An UAF issue was observed:
BUG: KASAN: slab-use-after-free in pagecounteruncharge+0x65/0x150 Write of size 8 at addr ffff888106715440 by task insmod/527
CPU: 4 UID: 0 PID: 527 Comm: insmod 6.19.0-rc7-next-20260129+ #11 Tainted: [O]=OOTMODULE Call Trace: <TASK> dumpstacklvl+0x82/0xd0 kasanreport+0xca/0x100 kasancheckrange+0x39/0x1c0 pagecounteruncharge+0x65/0x150 dmemcgroupuncharge+0x1f/0x260
Allocated by task 527:
Freed by task 0:
The buggy address belongs to the object at ffff888106715400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 64 bytes inside of freed 512-byte region [ffff888106715400, ffff888106715600)
The buggy address belongs to the physical page:
Memory state around the buggy address: ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
The issue occurs because a pool can still be held by a caller after its associated memory region is unregistered. The current implementation frees the pool even if users still hold references to it (e.g., before uncharge operations complete).
This patch adds a reference counter to each pool, ensuring that a pool is only freed when its reference count drops to zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel cgroup/dmemto a version that resolves this vulnerability.Patch cgroup/dmem: avoid pool UAF - Compensating control
Mitigate potential exploitation window by avoiding/limiting the use of the dmem cgroup subsystem (cgroup/dmem) until the kernel fix for pool use-after-free (cgroup/dmem: avoid pool UAF) is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23195?
CVE-2026-23195 has been classified as a high severity vulnerability due to the potential for a use-after-free condition in the Linux kernel.
How do I fix CVE-2026-23195?
To fix CVE-2026-23195, upgrade to the latest version of the Linux kernel that includes the patch for this vulnerability.
What are the potential impacts of CVE-2026-23195?
The potential impacts of CVE-2026-23195 include system crashes and security risks associated with allowing an attacker to execute code in kernel space.
In which version of the Linux kernel is CVE-2026-23195 present?
CVE-2026-23195 is present in Linux kernel versions up to and including 6.19.0-rc7-next-20260129.
What does CVE-2026-23195 affect in the Linux kernel?
CVE-2026-23195 affects the cgroup and dmem subsystems within the Linux kernel, specifically related to memory management.