CVE-2026-23195

Description

In the Linux kernel, the following vulnerability has been resolved:cgroup/dmem: avoid pool UAFAn UAF issue was observed:BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150Write of size 8 at addr ffff888106715440 by task insmod/527CPU: 4 UID: 0 PID: 527 Comm: insmod 6.19.0-rc7-next-20260129+ #11Tainted: [O]=OOT_MODULECall Trace:dump_stack_lvl+0x82/0xd0kasan_report+0xca/0x100kasan_check_range+0x39/0x1c0page_counter_uncharge+0x65/0x150dmem_cgroup_uncharge+0x1f/0x260Allocated by task 527:Freed by task 0:The buggy address belongs to the object at ffff888106715400which belongs to the cache kmalloc-512 of size 512The buggy address is located 64 bytes inside offreed 512-byte region [ffff888106715400, ffff888106715600)The buggy address belongs to the physical page:Memory state around the buggy address:ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fcffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc>ffff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fbffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fbThe issue occurs because a pool can still be held by a caller after itsassociated memory region is unregistered. The current implementation freesthe pool even if users still hold references to it (e.g., before unchargeoperations complete).This patch adds a reference counter to each pool, ensuring that a pool isonly freed when its reference count drops to zero.

Risk Information

Associated Vulnerability

Patch Details

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234