CVE-2026-23183 Overview
CVE-2026-23183 is a NULL pointer dereference vulnerability in the Linux kernel's cgroup/dmem subsystem. The flaw resides in the dmemcg_limit_write code path, which handles writes to the dmem.max control file. When a privileged user writes a region name without a corresponding limit value, the parser fails to validate the remaining options before passing them to strcmp, triggering a NULL pointer dereference in kernel mode. The result is a kernel oops that crashes the affected process context and can destabilize the host.
Critical Impact
A local user with write access to dmem.max can trigger a kernel NULL pointer dereference, resulting in denial of service through a kernel oops.
Affected Products
- Linux kernel (mainline, prior to the fix commit)
- Linux kernel 6.19-rc series (reproduced on 6.19.0-rc6-next-2026012)
- Distributions packaging kernels with the cgroup/dmem controller enabled
Discovery Timeline
- 2026-02-14 - CVE-2026-23183 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-23183
Vulnerability Analysis
The vulnerability lives in dmemcg_limit_write, the handler invoked when userspace writes to the dmem.max cgroup file. The handler parses input of the form region_name limit, extracting the region name first and then the limit value. When input lacks the limit portion, such as echo test/region0 > dmem.max, the parser still advances but leaves the options pointer NULL. The function then calls strcmp with a NULL argument, producing a supervisor read access fault at address 0x0.
The call trace confirms the path: ksys_write → vfs_write → kernfs_fop_write_iter → dmemcg_limit_write.constprop.0 → strcmp. The crash occurs at RIP: strcmp+0x10, with RDI set to 0x0. Because the dereference happens in kernel mode under a non-recoverable fault, the result is an Oops that taints the kernel and kills the writing task.
Root Cause
The root cause is missing input validation after parsing the region name in dmemcg_limit_write. The function does not verify that the remaining options string is non-NULL before passing it to downstream string comparison routines. The upstream fix, applied in commits 43151f812886 and c13816e8fa23, adds a check to confirm that options remain valid after parsing the region name and rejects the write with an error otherwise.
Attack Vector
Exploitation requires local access and the ability to write to a dmem.max cgroup file. In default configurations, only root or processes with appropriate cgroup delegation can write these files. An attacker satisfying that prerequisite issues a single shell command, for example echo test/region0 > dmem.max, to dereference a NULL pointer inside the kernel. The vulnerability does not provide a direct code execution primitive and is limited to denial of service through a kernel oops. No public proof of concept exploit is currently tracked, and the EPSS score reflects low expected exploitation likelihood.
Detection Methods for CVE-2026-23183
Indicators of Compromise
- Kernel log entries containing BUG: kernel NULL pointer dereference with RIP: strcmp in the call trace
- Oops messages referencing dmemcg_limit_write in the kernel backtrace
- Unexpected process termination for tasks writing to files named dmem.max under /sys/fs/cgroup
Detection Strategies
- Monitor dmesg and /var/log/kern.log for Oops events that include dmemcg_limit_write or strcmp in the backtrace.
- Audit writes to cgroup dmem.max files using auditd rules on paths under /sys/fs/cgroup to surface anomalous local activity.
- Correlate kernel oops events with the originating user identity and command line to identify potentially malicious local actors.
Monitoring Recommendations
- Forward kernel ring buffer messages to a centralized logging pipeline and alert on NULL pointer dereference patterns.
- Track the running kernel version across the fleet and flag hosts running unpatched releases that include the dmem controller.
- Baseline the population of processes writing to cgroup control files and investigate deviations.
How to Mitigate CVE-2026-23183
Immediate Actions Required
- Apply the upstream fix from kernel commits 43151f812886be1855d2cba059f9c93e4729460b and c13816e8fa23deec6a8d7465d9e637fd02683b5c once available in your distribution kernel.
- Restrict write access to dmem.max cgroup files to trusted administrators, and avoid delegating cgroup write capabilities to untrusted workloads.
- Inventory hosts running affected 6.19-rc development kernels and prioritize them for update.
Patch Information
The fix adds validation to confirm that parsed options remain valid after extracting the region name in dmemcg_limit_write. Patch details are available in the Kernel Git commit 43151f81 and the Kernel Git commit c13816e8. Distribution maintainers are expected to backport these commits to supported stable branches.
Workarounds
- If the dmem cgroup controller is not required, disable it in the cgroup hierarchy to remove the attack surface.
- Tighten filesystem permissions on cgroup control files so that only trusted system components can write dmem.max.
- Avoid scripts or tooling that write region names to dmem.max without an accompanying limit value until the patch is applied.
# Verify whether the dmem controller is exposed in the unified cgroup hierarchy
cat /sys/fs/cgroup/cgroup.controllers | tr ' ' '\n' | grep -w dmem
# If present and not required, disable it from a parent cgroup
echo '-dmem' > /sys/fs/cgroup/cgroup.subtree_control
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
