{
  "cveId": "CVE-2026-23195",
  "url": "https://patchblox.com/security/cve/CVE-2026-23195",
  "summary": "CVE-2026-23195 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23195 (version 6.18.10-1), released February 14, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  cgroup/dmem: avoid pool UAF  An UAF issue was ob...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  cgroup/dmem: avoid pool UAF  An UAF issue was observed:  BUG: KASAN: slab-use-after-free in page_counter_uncharge\u002B0x65/0x150 Write of size 8 at addr ffff888106715440 by task insmod/527  CPU: 4 UID: 0 PID: 527 Comm: insmod    6.19.0-rc7-next-20260129\u002B #11 Tainted: [O]=OOT_MODULE Call Trace: \u003CTASK\u003E dump_stack_lvl\u002B0x82/0xd0 kasan_report\u002B0xca/0x100 kasan_check_range\u002B0x39/0x1c0 page_counter_uncharge\u002B0x65/0x150 dmem_cgroup_uncharge\u002B0x1f/0x260  Allocated by task 527:  Freed by task 0:  The buggy address belongs to the object at ffff888106715400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 64 bytes inside of freed 512-byte region [ffff888106715400, ffff888106715600)  The buggy address belongs to the physical page:  Memory state around the buggy address: ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc \u003Effff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb \t\t\t\t     ^ ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb  The issue occurs because a pool can still be held by a caller after its associated memory region is unregistered. The current implementation frees the pool even if users still hold references to it (e.g., before uncharge operations complete).  This patch adds a reference counter to each pool, ensuring that a pool is only freed when its reference count drops to zero.",
  "published": "2026-02-14T17:15:57Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00129,
  "epssPercentile": 0.02545,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.10-1",
      "fix": "DEBIAN-CVE-2026-23195",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23195",
      "released": "2026-02-14T17:15:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}