CVE-2026-23195

A use-after-free vulnerability was found in the cgroup device memory (dmem) subsystem. When a memory region is unregistered, the associated pool is freed immediately even if callers still hold references to it, leading to use-after-free when subsequent uncharge operations access the freed pool.

The dmem cgroup subsystem is a relatively new feature primarily used for device memory accounting. This UAF requires specific timing between pool unregistration and pending uncharge operations, typically triggered by out-of-tree modules. The impact is a kernel crash or potential memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.