CVE-2026-23195: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23195 is a Use After Free (UAF) vulnerability in the Linux kernel's cgroup/dmem (device memory) subsystem. The flaw occurs when a memory pool is freed while callers still hold active references to it — specifically, a pool can be prematurely deallocated after its associated memory region is unregistered but before all uncharge operations complete. Affected versions include Linux kernel 6.14 through 6.18.9 and 6.19-rc1 through 6.19-rc8. It was published on February 14, 2026, with patches merged into the stable tree on March 19, 2026. The CVSS v3.1 base score is 7.8 (High) (Feedly, Kernel Patch 1).

The root cause is classified as CWE-416 (Use After Free). The vulnerability arises in the dmem_cgroup_uncharge path: when a device memory region is unregistered, the associated pool object is freed even if other callers still hold references to it. Subsequent operations — such as page_counter_uncharge — then access the freed slab memory, triggering a KASAN-detected write to a freed 512-byte kmalloc region. The attack vector is local, requiring low privileges and no user interaction, making it exploitable by any unprivileged local user on an affected system where the cgroup/dmem subsystem is active. A KASAN report in the bug description shows the write occurring at offset 64 bytes inside the freed region during insmod execution (Feedly).

Successful exploitation can result in kernel crashes (Denial of Service), data corruption, or potential privilege escalation through controlled memory corruption. Because the vulnerability resides in the kernel's cgroup/dmem subsystem, a local attacker with low privileges could manipulate device memory registration and unregistration sequences to trigger race conditions, potentially gaining elevated kernel-level access. The confidentiality, integrity, and availability impacts are all rated High, reflecting the severity of kernel-level memory corruption (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

Upgrade the Linux kernel to version 6.18.10 or later, which includes the fixes merged at stable commits 99a2ef500906138ba58093b9893972a5c303c734 and d3081353acaa6a638dcf75726066ea556a2de8d5. Systems running 6.19 release candidate versions should update to the next stable release once available. Organizations should prioritize patching systems where the cgroup/dmem subsystem is actively used, especially those accessible by untrusted local users. As a temporary measure, restricting local user access to cgroup/dmem interfaces may reduce exposure (Feedly, Kernel Patch 1, Kernel Patch 2).

The vulnerability received routine coverage from vulnerability tracking platforms including VulnDB, Vulners, and CVEFeed shortly after publication. A brief technical post appeared on infinitsec.net summarizing the cgroup/dmem UAF issue. No significant vendor statements, notable researcher commentary, or widespread media coverage has been observed beyond standard CVE aggregation (Feedly).