Security readout for executives and security teams
Plain-English summary
Affected Linux kernels can free a device-memory control-group pool while it is still in use. A later accounting operation can write into freed kernel memory, potentially causing a crash or broader system compromise. Exploitation requires local, low-privileged access and high complexity; public exploitation is not established by the supplied sources.
Executive priority
Treat this as a high-priority kernel maintenance issue on multi-user or locally accessible Linux systems. Prioritize exposed hosts and systems using the affected device-memory accounting path. Emergency incident response is not justified solely by this bundle because active exploitation is unconfirmed and exploitation is rated high complexity.
Technical view
The cgroup/dmem lifecycle incorrectly releases a pool when its memory region is unregistered, despite outstanding caller references. A subsequent uncharge reaches page_counter_uncharge and writes into the freed slab object. The referenced fix adds per-pool reference counting and delays deallocation until the count reaches zero.
Likely exposure
The bundle identifies Linux 6.14, 6.18.10, and 6.19 as affected, but also contains an ambiguous version entry of "0." Exposure is local rather than network-based according to the CVSS vector. Confirm exact distribution kernel ranges and backports with the relevant vendor.
Exploitation context
The CVSS vector rates attack complexity high and requires low local privileges, with no user interaction. The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. The demonstrated failure involved KASAN and an out-of-tree module, which may not represent every production configuration.
Researcher notes
The evidence clearly supports a pool-lifetime use-after-free and its reference-counting correction. It does not establish a reliable exploitation primitive, affected hardware requirements, configuration prerequisites, or complete fixed release boundaries. The KASAN report shows an eight-byte write during uncharge on a 6.19 release-candidate development kernel.
Mitigation direction
- Apply a distribution or vendor kernel update containing the applicable reference-counting fix.
- Confirm the update includes one of the referenced stable commits or an equivalent backport.
- Consult vendor guidance because the bundle does not name complete fixed-version ranges.
- Restrict untrusted local access while updates are pending; no source-backed product-specific workaround is documented.
Validation and detection
- Inventory deployed kernel versions and compare them with vendor advisories for CVE-2026-23195.
- Verify the running kernel contains the applicable fix through vendor changelogs or commit ancestry.
- Determine whether cgroup/dmem memory-region registration and unregistration paths are exercised.
- Review kernel diagnostics for use-after-free reports involving page_counter_uncharge or dmem_cgroup_uncharge.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23195 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d3081353acaa6a638dcf75726066ea556a2de8d5CVE reference, Linux
- https://git.kernel.org/stable/c/99a2ef500906138ba58093b9893972a5c303c734CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.