Executive brief
A memory management bug in the Linux kernel's DAMON (Data Access Monitoring) subsystem can cause memory leaks and uninitialized memory access when directory setup fails. This affects the kernel's internal memory monitoring feature used for performance optimization and can potentially crash the system or expose sensitive kernel memory if triggered by a privileged user.
Technical details
The vulnerability is a reference-counting error in the damon_sysfs_scheme_add_dirs() function in mm/damon/sysfs-schemes.c. When setup of the tried_regions directory fails, the error path incorrectly attempts to release the tried_regions kobject instead of the stats kobject, resulting in a leaked stats object. More critically, if the tried_regions allocation itself fails, the scheme->tried_regions field remains uninitialized, and the subsequent kobject_put() call dereferences this uninitialized memory pointer, causing a use-after-free. The fix corrects the error label to properly release the stats directory. No authentication is required as this affects internal kernel code that may be triggered by local privileged operations. Patches have been released for stable kernel versions 6.2.x and later.
Affected products
- Linux Linux Kernel 6.2.x and later affected versions
Timeline
- 2026-08-15: disclosed
- 2026-07-01: patched