Executive brief
The Linux kernel's DAMON (Data Access Monitoring) memory tiering sample code has a use-after-free vulnerability. When a DAMON context fails to stop (due to earlier memory allocation issues), the code deallocates the context memory anyway, but the background monitoring thread continues running and accessing freed memory, potentially causing system instability or information disclosure.
Technical details
The vulnerability is a use-after-free in the samples/damon/mtier.c module. The root cause is that damon_sample_mtier_stop() calls damon_stop() on two DAMON contexts simultaneously without checking the return value, then unconditionally deallocates both contexts. If damon_stop() fails (e.g., because one context is already stopped due to earlier memory allocation failures in kdamond_fn()), the unstopped context's background thread (kdamond) continues executing with references to now-freed damon_target and damon_region objects. The fix separates the damon_stop() calls to be invoked one context at a time, allowing proper error handling. This is a sample/example code vulnerability in kernel versions 6.16.x and later, affecting DAMON-based memory tiering implementations.
Affected products
- Linux Linux kernel 6.16.x and later
Timeline
- 2026-09-16: disclosed
- 2026-09-11: patched: Fix committed upstream and backported to stable branches