Executive brief
A vulnerability was identified in the Linux kernel's memory management subsystem (DAMON). A technical error in how the system tracks memory groups could lead to a resource leak, potentially slowing down the system or causing stability issues over time. This affects systems using specific memory monitoring features and has been resolved in recent kernel updates.
Technical details
A reference leak exists in mm/damon/sysfs-schemes.c within the Linux kernel. The function damon_sysfs_memcg_path_to_id() breaks out of a mem_cgroup_iter() loop without calling mem_cgroup_iter_break(), which is required to properly release the reference to the cgroup object. This results in a cgroup reference leak. An attacker with local access to the DAMON sysfs interface could potentially trigger this leak repeatedly to exhaust system resources. The issue has been patched across multiple stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux 6.3 to 7.0.11
Timeline
- 2026-04-26: other: Fix authored by SeongJae Park
- 2026-06-01: patched: Fix committed to stable trees
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/082351f9d40007414ad6af062b3a26fa02fd4b5f
- https://git.kernel.org/stable/c/1bd31386ec3b9ccec10c04429948a306ec5897c0
- https://git.kernel.org/stable/c/302e02f9ba49f81418ec2a749ae6f5cac1d424e9
- https://git.kernel.org/stable/c/30a361be33f3793b9ecbd10ab7be6d0564819b79
- https://git.kernel.org/stable/c/d4e7b5c4cc353f154d5ab8bb2e1ce7714d77a6e9