Executive brief
A vulnerability was identified in the Linux kernel's Data Access Monitoring (DAMON) subsystem. This component helps manage system memory efficiency. An issue in how the system handles user requests to read or write memory management configuration files could lead to a system crash or unpredictable behavior. This occurs when two different processes attempt to access the same configuration path simultaneously.
Technical details
A use-after-free (UAF) vulnerability was discovered in mm/damon/sysfs-schemes.c within the Linux kernel. The root cause is a race condition where user-driven direct reads and writes to the 'memcg_path' and 'path' sysfs files were not protected by the 'damon_sysfs_lock'. While the write operation deallocates the buffer pointing to the path, a concurrent reader using a separate open file descriptor could access the already freed memory. This occurs because kernfs open file locking only prevents races within the same open file instance. Attackers with local access to the sysfs interface could potentially trigger this race to cause a kernel oops or memory corruption. The fix involves wrapping both the show and store operations for these paths with the 'damon_sysfs_lock' mutex.
Affected products
- Linux Linux kernel 6.16.x and earlier versions
Timeline
- 2026-04-23: disclosed: Initial patch submitted by SeongJae Park
- 2026-05-28: advisory: CVE-2026-46121 published by NVD
References
- https://git.kernel.org/stable/c/1e68eb96e8beb1abefd12dd22c5637795d8a877e
- https://git.kernel.org/stable/c/b1e9f2d5870776347edef927f9bb3ea19b8e3abb
- https://git.kernel.org/stable/c/baecc45ad60e621ef14d6c1e7f41ef36bbfdf910
- https://git.kernel.org/stable/c/c88802d0e8edd14b6cd2daf3000f99adbc4c85c5
- https://git.kernel.org/stable/c/eafd6f5372d29b0dd213799b92c2c9c7ad31d7da