CVE-2026-23183

Root

Cause A NULL pointer dereference vulnerability exists in the Linux kernel's cgroup/dmem subsystem. When writing a value to dmem.max without a proper numeric limit, such as the command echo test/region0 > dmem.max, the kernel attempts to compare the parsed region name via strcmp, but the pointer passed to the function can be NULL. This occurs because the code does not validate whether the parsed region name is a valid string pointer before using it [1].

Exploitation

An attacker with local access and the ability to write to the dmem.max cgroup file can trigger this bug. No special privileges beyond basic cgroup write access are required, as the crash occurs during normal file I/O operations. The issue is triggered by providing a region name string that fails to parse into a valid memory region pointer, leaving the pointer at NULL [1].

Impact

Successful exploitation causes a kernel NULL pointer dereference, leading to a system crash (Oops) and denial of service. The crash trace showed a read access at address 0x0000000000000000, resulting in immediate system instability. This vulnerability can be used to crash the system from a non-root context if the attacker has appropriate cgroup file write permissions.

Mitigation

The fix has been applied in the Linux kernel stable tree commit c13816e8fa23deec6a8d7465d9e637fd02683b5c. Users should update their kernel to include this commit or a subsequent release containing the backport. No workaround is provided; manual validation of the input before writing to dmem.max would prevent the crash, but the proper fix is to update the kernel [1].