CVE-2026-23195

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cgroup/dmem: avoid pool UAF<br /> <br /> An UAF issue was observed:<br /> <br /> BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150<br /> Write of size 8 at addr ffff888106715440 by task insmod/527<br /> <br /> CPU: 4 UID: 0 PID: 527 Comm: insmod 6.19.0-rc7-next-20260129+ #11<br /> Tainted: [O]=OOT_MODULE<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x82/0xd0<br /> kasan_report+0xca/0x100<br /> kasan_check_range+0x39/0x1c0<br /> page_counter_uncharge+0x65/0x150<br /> dmem_cgroup_uncharge+0x1f/0x260<br /> <br /> Allocated by task 527:<br /> <br /> Freed by task 0:<br /> <br /> The buggy address belongs to the object at ffff888106715400<br /> which belongs to the cache kmalloc-512 of size 512<br /> The buggy address is located 64 bytes inside of<br /> freed 512-byte region [ffff888106715400, ffff888106715600)<br /> <br /> The buggy address belongs to the physical page:<br /> <br /> Memory state around the buggy address:<br /> ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc<br /> ffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc<br /> &gt;ffff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb<br /> ^<br /> ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb<br /> ffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb<br /> <br /> The issue occurs because a pool can still be held by a caller after its<br /> associated memory region is unregistered. The current implementation frees<br /> the pool even if users still hold references to it (e.g., before uncharge<br /> operations complete).<br /> <br /> This patch adds a reference counter to each pool, ensuring that a pool is<br /> only freed when its reference count drops to zero.