Executive brief
A vulnerability was identified in the Linux kernel's Data Access Monitoring (DAMON) subsystem. This component helps manage and monitor how memory is accessed by different parts of the system. Under specific conditions, particularly when refreshing monitoring data rapidly, the system could experience a crash or memory corruption. This could lead to system instability or a denial of service for local users.
Technical details
A use-after-free (UAF) vulnerability exists in mm/damon/sysfs-schemes.c within the Linux kernel. The DAMON sysfs interface manages 'tried region' directory objects using a linked list. The vulnerability is rooted in the fact that the removal function, damon_sysfs_scheme_regions_rm_dirs(), decrements the kobject reference count but relies on a delayed release callback to remove the object from the linked list. If a user requests a refresh of these directories before the callback executes, the list can become corrupted, leading to a use-after-free. This is particularly reproducible on kernels built with CONFIG_DEBUG_KOBJECT_RELEASE. The fix involves explicitly removing the region object from the list during the reference count decrement and ensuring objects are only added to the list after successful initialization.
Affected products
- Linux Linux Kernel 6.2.x and later
Timeline
- 2026-05-18: disclosed: Initial patch submitted by SeongJae Park
- 2026-06-09: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-07-24: advisory: CVE-2026-64239 published
References
- https://git.kernel.org/stable/c/0ba6c05156d9ff9fc6ca22b7690e2eec9eca66f7
- https://git.kernel.org/stable/c/2c33177023c92e76806c535ddbffaa3d3fc37777
- https://git.kernel.org/stable/c/441f92f7d386b85bad16de49db95a307cba048a2
- https://git.kernel.org/stable/c/a5fa42214de55e43d165144727ce9facb9fc6b08
- https://git.kernel.org/stable/c/c0e37017a452addec873865c94cf7a665663a9b2