HIGH
cgroup dmem Pool UAF
CVE-2026-23195
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: cgroup/dmem: avoid pool UAF An UAF issue was observed: BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150 Write of size 8 at addr ffff888106715440 by task insmod/527 CPU: 4 UID: 0 PID: 527 Comm: insmod 6.19.0-rc7-next-20260129+ #11 Tainted: [O]=OOT_MODULE Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 kasan_report+0xca/0x100 kasan_check_range+0x39/0x1c0 page_counter_uncharge+0x65/0x150 dmem_cgroup_uncharge+0x1f/0x260 Allocated by task 527: Freed by task 0: The buggy address belongs to the object at ffff888106715400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 64 bytes inside of freed 512-byte region [ffff888106715400, ffff888106715600) The buggy address belongs to the physical page: Memory state around the buggy address: ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb The issue occurs because a pool can still be held by a caller after its associated memory region is unregistered. The current implementation frees the pool even if users still hold references to it (e.g., before uncharge operations complete). This patch adds a reference counter to each pool, ensuring that a pool is only freed when its reference count drops to zero.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability in the kernel's dmem cgroup subsystem could allow local attackers to corrupt kernel memory and potentially escalate privileges. The bug occurs when device memory pools are freed while still being accessed by concurrent operations, leading to memory corruption that could be exploited for code execution.
Vulnerability analysis
Root Cause: The cgroup dmem subsystem had a race condition where pool objects could be freed while still being referenced by ongoing operations. When a memory region was unregistered, the associated pools were immediately freed without checking if other threads still held references to them (e.g., during uncharge operations). This created a window where freed pool memory could be accessed, leading to use-after-free corruption.
Attack Surface: This vulnerability affects systems using the dmem cgroup controller for device memory accounting, which is primarily used for GPU memory management. The bug is triggered through normal cgroup operations like region unregistration concurrent with memory charge/uncharge operations. Local access is required to manipulate cgroup settings or trigger device memory operations.
Fix Mechanism: The patch implements proper reference counting for dmem_cgroup_pool_state objects using refcount_t. Each pool now maintains a reference count that is incremented when the pool is accessed and decremented when operations complete. The pool is only freed via RCU callback when the reference count reaches zero. Key changes include: (1) Adding refcount_t ref field to pool structure, (2) Implementing dmemcg_pool_get/put/tryget functions for reference management, (3) Taking references during charge/uncharge operations, (4) Using RCU-safe deferred freeing in dmemcg_pool_free_rcu, (5) Ensuring parent pool references are properly managed.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.18 | 6.18.10 | d3081353acaa |
| mainline | 6.19 | 99a2ef500906 |