CVE-2023-52939 mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
A NULL pointer dereference in the Linux kernel memory control group subsystem can cause a system crash when handling hardware-poisoned pages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52939?
CVE-2023-52939 is a medium-severity vulnerability in Linux kernel, published on 27 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
As commit 18365225f044 ("hwpoison, memcg: forcibly uncharge LRU pages"), hwpoison will forcibly uncharg a LRU hwpoisoned page, the folio_memcg could be NULl, then, mem_cgroup_track_foreign_dirty_slowpath() could occurs a NULL pointer dereference, let's do not record the foreign writebacks for folio memcg is null in mem_cgroup_track_foreign_dirty() to fix it.
Weakness: CWE-476
Which versions are affected by CVE-2023-52939?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52939?
Apply the vendor's patch.
Is CVE-2023-52939 being exploited?
There is no known exploitation of CVE-2023-52939 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-60367, BELL-CVE-2023-52939, DEBIAN-CVE-2023-52939, GHSA-p579-25jc-wxr5, ROOT-OS-DEBIAN-11-CVE-2023-52939, ROOT-OS-UBUNTU-2204-CVE-2023-52939 and 1 more.