Executive brief
The Linux kernel's DAMON (Data Access Monitoring) sample module fails to properly clean up memory when a monitoring operation fails to start. An administrator can trigger repeated memory leaks by attempting to enable DAMON monitoring multiple times while another monitoring instance is running, causing memory consumption to increase indefinitely and potentially degrading system performance.
Technical details
This vulnerability is a resource leak in the DAMON sample module's wsse component. The root cause is that damon_sample_wsse_start() does not free the allocated DAMON context when damon_start() fails—it only cleans up resources on earlier buildup failures. The vulnerability requires administrator privileges to trigger and can be reliably reproduced by attempting to start DAMON in exclusive mode while another instance is already running. An attacker with sudo access can repeatedly cause the damon_start() call to fail, leaking DAMON context memory with each attempt. A fix has been provided that ensures the context is freed in case of damon_start() failure.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-16: disclosed
- patched: Fix provided in patch series samples/damon: handle damon_{start,stop}() failures