LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23225: sched/mmcid: Don't assume CID is CPU owned on mode switch

In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't assume CID is CPU owned on mode switch Shinichiro reported a KASAN UAF, which is actually an out of bounds access in the MMCID management code. CPU0 CPU1 T1 runs in userspace T0: fork(T4) -> Switch to per CPU CID mode fixup() set MM_CID_TRANSIT on T1/CPU1 T4 exit() T3 exit() T2 exit() T1 exit() switch to per task mode ---> Out of bounds access. As T1 has not scheduled after T0 set the TRANSIT bit, it exits with the TRANSIT bit set. sched_mm_cid_remove_user() clears the TRANSIT bit in the task and drops the CID, but it does not touch the per CPU storage. That's functionally correct because a CID is only owned by the CPU when the ONCPU bit is set, which is mutually exclusive with the TRANSIT flag. Now sched_mm_cid_exit() assumes that the CID is CPU owned because the prior mode was per CPU. It invokes mm_drop_cid_on_cpu() which clears the not set ONCPU bit and then invokes clear_bit() with an insanely large bit number because TRANSIT is set (bit 29). Prevent that by actually validating that the CID is CPU owned in mm_drop_cid_on_cpu().

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux's memory-context ID scheduling code can cause out-of-bounds kernel memory access when process exit overlaps an MMCID mode switch. A local, low-privileged user may be able to trigger it without user interaction. The supplied CVSS rates potential confidentiality, integrity, and availability impact as high, but the sources do not prove practical privilege escalation or active exploitation.

Executive priority

Treat this as a high-priority kernel update for multi-user Linux systems, shared compute, developer hosts, and machines permitting untrusted local code. Internet-facing status alone does not determine exposure because the attack vector is local. Patch during an accelerated maintenance cycle after confirming affected packages; escalate faster where local trust boundaries are weak.

Technical view

During MMCID mode changes, a task can exit while MM_CID_TRANSIT remains set. sched_mm_cid_exit() may then treat the CID as CPU-owned and call mm_drop_cid_on_cpu(). Clearing a nonexistent ONCPU state can pass the TRANSIT bit value as an enormous bitmap index, causing out-of-bounds access. The fix validates CPU ownership before dropping the CID.

Likely exposure

Exposure is limited to Linux systems running affected kernels where low-privileged users or workloads can exercise the vulnerable scheduling path. The bundle's affected-version entry contains 6.19, 0, 6.19.1, and 7.0, but does not preserve clear range semantics. Confirm distribution backports and exact package status against the CVE record and referenced commits.

Exploitation context

The supplied record is not in CISA KEV, and no provided source reports active exploitation or a public exploit. The CVSS vector describes a local, low-complexity, low-privilege attack requiring no user interaction. The disclosure documents the fault condition and fix, but does not establish reliable exploitation beyond triggering the memory-safety error.

Researcher notes

KASAN initially presented the issue as use-after-free, but the report identifies an out-of-bounds bitmap access. MM_CID_TRANSIT can survive until task exit without ONCPU ownership; subsequent per-CPU cleanup misinterprets bit 29 as a CID index. Review both referenced kernel commits for exact guards and backport context; the bundle does not map each commit to a specific release.

Mitigation direction

  • Inventory Linux kernels and identify systems matching the CVE record's affected version information.
  • Apply a vendor-supported kernel containing the referenced ownership-validation fix, following distribution guidance.
  • Prioritize multi-user hosts and systems where untrusted local users can run processes.
  • If patching is delayed, restrict untrusted local access and monitor vendor guidance for supported mitigations.

Validation and detection

  • Confirm the running kernel package and distribution build on every potentially exposed host.
  • Check whether the vendor package includes either referenced fix commit or an equivalent backport.
  • Run vendor regression and memory-safety tests in staging after updating.
  • Monitor kernel logs for KASAN or out-of-bounds reports involving MMCID management.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23225 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-23225Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux007d84287c7466ca68a5809b616338214dc5b77b, 007d84287c7466ca68a5809b616338214dc5b77bunaffected
LinuxLinux6.19, 0, 6.19.1, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.