CVE-2026-23225

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23225", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.987Z", "datePublished": "2026-02-18T14:53:28.387Z", "dateUpdated": "2026-08-05T12:20:43.404Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:43.404Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/mmcid: Don't assume CID is CPU owned on mode switch\n\nShinichiro reported a KASAN UAF, which is actually an out of bounds access\nin the MMCID management code.\n\n CPU0\t\t\t\t\t\tCPU1\n \t\t\t\t\t\tT1 runs in userspace\n T0: fork(T4) -> Switch to per CPU CID mode\n fixup() set MM_CID_TRANSIT on T1/CPU1\n T4 exit()\n T3 exit()\n T2 exit()\n\t\t\t\t\t\tT1 exit() switch to per task mode\n\t\t\t\t\t\t ---> Out of bounds access.\n\nAs T1 has not scheduled after T0 set the TRANSIT bit, it exits with the\nTRANSIT bit set. sched_mm_cid_remove_user() clears the TRANSIT bit in\nthe task and drops the CID, but it does not touch the per CPU storage.\nThat's functionally correct because a CID is only owned by the CPU when\nthe ONCPU bit is set, which is mutually exclusive with the TRANSIT flag.\n\nNow sched_mm_cid_exit() assumes that the CID is CPU owned because the\nprior mode was per CPU. It invokes mm_drop_cid_on_cpu() which clears the\nnot set ONCPU bit and then invokes clear_bit() with an insanely large\nbit number because TRANSIT is set (bit 29).\n\nPrevent that by actually validating that the CID is CPU owned in\nmm_drop_cid_on_cpu()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered through fork() and exit() syscalls, requiring local access to the system. There is no network or adjacent vector to reach this code path.\nAC:L - The attacker controls both sides of the race - they create and exit threads in their own process. By spawning multiple threads and controlling fork/exit timing, the race condition between mode transition and exit with the TRANSIT bit set is reliably triggerable.\nPR:L - Any unprivileged local user can trigger this by creating a multi-threaded process and having threads fork and exit in specific patterns. No special privileges or capabilities are required.\nUI:N - No user interaction is needed. The attacker can trigger the vulnerability entirely through their own process's fork/exit operations.\nS:U - The vulnerability causes kernel memory corruption within the same security scope. There is no evidence of crossing a security boundary such as VM escape or sandbox escape.\nC:H - The out-of-bounds write (clear_bit at ~64MB offset past the cidmask bitmap) corrupts kernel heap memory. Such kernel memory corruption can be leveraged to create read primitives through corrupted kernel data structures.\nI:H - The bug performs an out-of-bounds clear_bit() at a massive offset (~64MB) into kernel memory, directly corrupting kernel data structures. This arbitrary kernel memory write can be leveraged for control flow hijacking.\nA:H - The out-of-bounds memory access was detected by KASAN as a UAF/OOB, causing a kernel crash. Even without KASAN, writing to arbitrary kernel memory at such a large offset will likely cause a kernel panic or oops."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/core.c", "kernel/sched/sched.h"], "versions": [{"version": "007d84287c7466ca68a5809b616338214dc5b77b", "lessThan": "81f29975631db8a78651b3140ecd0f88ffafc476", "status": "affected", "versionType": "git"}, {"version": "007d84287c7466ca68a5809b616338214dc5b77b", "lessThan": "1e83ccd5921a610ef409a7d4e56db27822b4ea39", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/core.c", "kernel/sched/sched.h"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.1", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/81f29975631db8a78651b3140ecd0f88ffafc476"}, {"url": "https://git.kernel.org/stable/c/1e83ccd5921a610ef409a7d4e56db27822b4ea39"}], "title": "sched/mmcid: Don't assume CID is CPU owned on mode switch", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/sched/core.c", "kernel/sched/sched.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "81f29975631db8a78651b3140ecd0f88ffafc476", "status": "affected", "version": "007d84287c7466ca68a5809b616338214dc5b77b", "versionType": "git"}, {"lessThan": "1e83ccd5921a610ef409a7d4e56db27822b4ea39", "status": "affected", "version": "007d84287c7466ca68a5809b616338214dc5b77b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/sched/core.c", "kernel/sched/sched.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/mmcid: Don't assume CID is CPU owned on mode switch\n\nShinichiro reported a KASAN UAF, which is actually an out of bounds access\nin the MMCID management code.\n\n CPU0\t\t\t\t\t\tCPU1\n \t\t\t\t\t\tT1 runs in userspace\n T0: fork(T4) -> Switch to per CPU CID mode\n fixup() set MM_CID_TRANSIT on T1/CPU1\n T4 exit()\n T3 exit()\n T2 exit()\n\t\t\t\t\t\tT1 exit() switch to per task mode\n\t\t\t\t\t\t ---> Out of bounds access.\n\nAs T1 has not scheduled after T0 set the TRANSIT bit, it exits with the\nTRANSIT bit set. sched_mm_cid_remove_user() clears the TRANSIT bit in\nthe task and drops the CID, but it does not touch the per CPU storage.\nThat's functionally correct because a CID is only owned by the CPU when\nthe ONCPU bit is set, which is mutually exclusive with the TRANSIT flag.\n\nNow sched_mm_cid_exit() assumes that the CID is CPU owned because the\nprior mode was per CPU. It invokes mm_drop_cid_on_cpu() which clears the\nnot set ONCPU bit and then invokes clear_bit() with an insanely large\nbit number because TRANSIT is set (bit 29).\n\nPrevent that by actually validating that the CID is CPU owned in\nmm_drop_cid_on_cpu()."}, {"lang": "es", "value": "Se ha resuelto la siguiente vulnerabilidad en el kernel de Linux:\n\nsched/mmcid: No asumir que el CID es propiedad de la CPU en el cambio de modo\n\nShinichiro inform\u00f3 de un KASAN UAF, que en realidad es un acceso fuera de l\u00edmites en el c\u00f3digo de gesti\u00f3n de MMCID.\n\n CPU0\t\t\t\t\t\tCPU1\n \t\t\t\t\t\tT1 se ejecuta en espacio de usuario\n T0: fork(T4) -> Cambio a modo CID por CPU\n fixup() establece MM_CID_TRANSIT en T1/CPU1\n T4 sale()\n T3 sale()\n T2 sale()\n\t\t\t\t\t\tT1 sale() cambia a modo por tarea\n\t\t\t\t\t\t ---> Acceso fuera de l\u00edmites.\n\nComo T1 no se ha planificado despu\u00e9s de que T0 estableciera el bit TRANSIT, sale con el bit TRANSIT establecido. sched_mm_cid_remove_user() borra el bit TRANSIT en la tarea y elimina el CID, pero no toca el almacenamiento por CPU. Eso es el funcionalmente correcto porque un CID solo es propiedad de la CPU cuando el bit ONCPU est\u00e1 establecido, lo cual es mutuamente excluyente con el indicador TRANSIT.\n\nAhora sched_mm_cid_exit() asume que el CID es propiedad de la CPU porque el modo anterior era por CPU. Invoca mm_drop_cid_on_cpu() que borra el bit ONCPU no establecido y luego invoca clear_bit() con un n\u00famero de bit incre\u00edblemente grande porque TRANSIT est\u00e1 establecido (bit 29).\n\nEvitar eso validando realmente que el CID es propiedad de la CPU en mm_drop_cid_on_cpu()."}], "id": "CVE-2026-23225", "lastModified": "2026-06-17T10:21:08.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-02-18T16:22:32.260", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1e83ccd5921a610ef409a7d4e56db27822b4ea39"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81f29975631db8a78651b3140ecd0f88ffafc476"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: sched/mmcid: Don't assume CID is CPU owned on mode switch", "id": "2440676", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440676"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23225", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23225\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23225\nhttps://lore.kernel.org/linux-cve-announce/2026021807-CVE-2026-23225-2a27@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,81f29975631db8a78651b3140ecd0f88ffafc476)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.1,6.20.0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-15T15:48:23.178095+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes the MMCID fix from the referenced commit.", "If an immediate kernel upgrade is not feasible, disable per\u2011CPU CID mode in the kernel configuration until the patch can be applied.", "Inspect and remove or update any custom modules that modify or rely on task CIDs, ensuring they are compatible with the patched kernel."], "summary": {"action": "Immediate Patch", "impact": "Kernel out-of-bounds access that can lead to privilege escalation"}, "threat_synthesis": {"affected_systems": "Any Linux kernel build that contains the unpatched MMCID code is vulnerable. The advisory does not list specific releases, so all kernels prior to the commit that introduces the fix must be considered affected.", "description_and_impact": "A bug in the Linux kernel scheduler occurs when it assumes a CPU\u2011owned CID during a mode switch, causing mm_drop_cid_on_cpu to clear a bit with an extremely large index. This results in an out-of-bounds write into per-CPU storage, which can corrupt kernel memory and provide a local attacker with the ability to gain elevated privileges or destabilize the system. The flaw represents a kernel-space use\u2011after\u2011free or buffer overflow weakness.", "risk_and_exploitability": "The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of public exploitation at this time. The vulnerability resides in core scheduler logic, so exploitation would require local access to influence task scheduling or trigger the mode switch. The flaw is not currently listed in the CISA KEV catalog."}}}}, "created": "2026-02-19T10:11:46.746654+00:00", "updated": "2026-04-15T17:30:10.418468+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-788"]}