CVE-2026-23183: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23183 is a NULL pointer dereference vulnerability in the Linux kernel's cgroup device memory (dmem) subsystem. It is triggered when setting a resource maximum without a limitation value, causing a kernel crash via a NULL pointer dereference in the strcmp function called from dmemcg_limit_write. The vulnerability was published on February 14, 2026, and affects the Linux kernel (specific stable versions subject to the dmem cgroup implementation). The CVSS category is estimated as Medium, with an EPSS score of 0.00021 (Feedly, Tenable).

The root cause is a NULL pointer dereference (CWE-476) in the dmemcg_limit_write function within the Linux kernel's cgroup dmem (device memory) controller. When a user writes a resource limit to the cgroup interface (e.g., echo test/re... > cgroup.dmem.max) without providing a valid device name or limitation string, the code passes a NULL pointer to strcmp, triggering a kernel oops. The call trace shows the fault originates at strcmp+0x10/0x30 → dmemcg_limit_write.constprop.0+0x16d/0x390 → kernfs_fop_write_iter → vfs_write → ksys_write, indicating the vulnerability is reachable via a standard write syscall to a cgroup filesystem node. Fixes are referenced in kernel stable commits (Kernel Git, Kernel Git).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic (oops) and system crash, directly impacting availability. Because the vulnerability is reachable by a local user with write access to the cgroup dmem interface (typically requiring elevated or container-management privileges), it can be used as a local denial-of-service vector. There is no evidence of confidentiality or integrity impact beyond the system crash (Feedly).

1. Gain local access: Obtain a local shell on a Linux system running a vulnerable kernel version with the cgroup dmem controller enabled.
2. Locate the cgroup dmem interface: Navigate to a cgroup directory exposing the dmem resource limit file, e.g., /sys/fs/cgroup/<cgroup_name>/.
3. Trigger the NULL pointer dereference: Write a malformed or incomplete resource limit string (without a valid device name) to the dmem max file, for example: echo 'test/resource' > /sys/fs/cgroup/<cgroup>/dmem.max.
4. Observe kernel crash: The kernel will dereference a NULL pointer in strcmp within dmemcg_limit_write, causing a kernel oops/panic and system crash (Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing BUG: kernel NULL pointer dereference, address: 0000000000000000 and call trace referencing dmemcg_limit_write and strcmp.
• Process: Unusual write activity to cgroup dmem interface files (e.g., /sys/fs/cgroup/*/dmem.max) by non-root or container management processes.
• System: Unexpected system reboots or kernel panics on hosts running Linux kernel versions with the dmem cgroup controller (Feedly).

Apply the upstream Linux kernel patches referenced in the stable tree commits for this vulnerability. The fixes are available at kernel stable commits 43151f812886be1855d2cba059f9c93e4729460b and c13816e8fa23deec6a8d7465d9e637fd02683b5c. As a workaround, restrict write access to cgroup dmem interface files to trusted administrators only, or disable the dmem cgroup controller if not required. Monitor vendor distributions (e.g., Red Hat, Ubuntu, SUSE) for backported patches in their respective kernel packages (Kernel Git, Kernel Git, Tenable).