CVE-2026-23195
Published: 14 February 2026
Summary
CVE-2026-23195 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SC-39 (Process Isolation).
Deeper analysis
CVE-2026-23195 is a use-after-free (UAF) vulnerability in the Linux kernel's cgroup/dmem subsystem. The issue arises because a memory pool can still be referenced by callers after its associated memory region is unregistered, leading to the pool being freed prematurely even while references persist, such as during uncharge operations. This was observed in a kernel crash report involving a slab-use-after-free in page_counter_uncharge called from dmem_cgroup_uncharge, affecting kernel version 6.19.0-rc7-next-20260129 and potentially similar versions.
A local attacker with low privileges (PR:L) can exploit this vulnerability, though it requires high attack complexity (AC:H) and does not involve user interaction (UI:N). Successful exploitation could result in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged security scope (S:U), as indicated by the CVSS v3.1 base score of 7.0.
The provided references point to kernel patch commits that mitigate the issue by adding a reference counter to each pool object. This ensures the pool is only freed when its reference count reaches zero, preventing UAF during concurrent unregistration and uncharge operations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5849
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: cgroup/dmem: avoid pool UAF An UAF issue was observed: BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150 Write of size 8 at addr ffff888106715440 by task insmod/527 CPU: 4 UID: 0 PID: 527…
more
Comm: insmod 6.19.0-rc7-next-20260129+ #11 Tainted: [O]=OOT_MODULE Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 kasan_report+0xca/0x100 kasan_check_range+0x39/0x1c0 page_counter_uncharge+0x65/0x150 dmem_cgroup_uncharge+0x1f/0x260 Allocated by task 527: Freed by task 0: The buggy address belongs to the object at ffff888106715400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 64 bytes inside of freed 512-byte region [ffff888106715400, ffff888106715600) The buggy address belongs to the physical page: Memory state around the buggy address: ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb The issue occurs because a pool can still be held by a caller after its associated memory region is unregistered. The current implementation frees the pool even if users still hold references to it (e.g., before uncharge operations complete). This patch adds a reference counter to each pool, ensuring that a pool is only freed when its reference count drops to zero.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF in cgroup/dmem directly enables privilege escalation from low-privileged user context to full system compromise (high C/I/A impact).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires memory protection mechanisms that would enforce reference counting to prevent premature free of cgroup/dmem pools while references remain.
Requires process/kernel isolation boundaries that limit the ability of one cgroup memory operation to corrupt or reuse freed pool objects of another.
Requires integrity checks that could detect corrupted slab objects resulting from the UAF during page_counter_uncharge.