CVE-2026-46121 (GCVE-0-2026-46121)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-06-14 17:55
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Patch series "mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path". Reads of 'memcg_path' and 'path' files in DAMON sysfs interface could race with their writes, results in use-after-free. Fix those. This patch (of 2): damon_sysfs_scheme_filter->mmecg_path can be read and written by users, via DAMON sysfs memcg_path file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters committing are protected by damon_sysfs_lock to avoid the sysfs files being destroyed while any of the parameters are being read. But the user-driven direct reads and writes are not protected by any lock, while the write is deallocating the memcg_path-pointing buffer. As a result, the readers could read the already freed buffer (user-after-free). Note that the user-reads don't race when the same open file is used by the writer, due to kernfs's open file locking. Nonetheless, doing the reads and writes with separate open files would be common. Fix it by protecting both the user-direct reads and writes with damon_sysfs_lock.
References
Impacted products
Vendor Product Version
Linux Linux Version: 490a43d07f1663d827e802720d30cbc0494e4f81
Version: c5d5b0047b0c0f304608f3824139f7bd34c48413
Version: 4f489fe6afb395dbc79840efa3c05440b760d883
Version: 4f489fe6afb395dbc79840efa3c05440b760d883
Version: 4f489fe6afb395dbc79840efa3c05440b760d883
Version: 4a158ac0538dd5695eeaa00aa0720d711f3e4ef1
Version: 6.6.96   ≤
Version: 6.12.36   ≤
Version: 6.15.5   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/damon/sysfs-schemes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b1e9f2d5870776347edef927f9bb3ea19b8e3abb",
              "status": "affected",
              "version": "490a43d07f1663d827e802720d30cbc0494e4f81",
              "versionType": "git"
            },
            {
              "lessThan": "c88802d0e8edd14b6cd2daf3000f99adbc4c85c5",
              "status": "affected",
              "version": "c5d5b0047b0c0f304608f3824139f7bd34c48413",
              "versionType": "git"
            },
            {
              "lessThan": "eafd6f5372d29b0dd213799b92c2c9c7ad31d7da",
              "status": "affected",
              "version": "4f489fe6afb395dbc79840efa3c05440b760d883",
              "versionType": "git"
            },
            {
              "lessThan": "baecc45ad60e621ef14d6c1e7f41ef36bbfdf910",
              "status": "affected",
              "version": "4f489fe6afb395dbc79840efa3c05440b760d883",
              "versionType": "git"
            },
            {
              "lessThan": "1e68eb96e8beb1abefd12dd22c5637795d8a877e",
              "status": "affected",
              "version": "4f489fe6afb395dbc79840efa3c05440b760d883",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a158ac0538dd5695eeaa00aa0720d711f3e4ef1",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.140",
              "status": "affected",
              "version": "6.6.96",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.88",
              "status": "affected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/damon/sysfs-schemes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.6.96",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.12.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock\n\nPatch series \"mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path\".\n\nReads of \u0027memcg_path\u0027 and \u0027path\u0027 files in DAMON sysfs interface could race\nwith their writes, results in use-after-free.  Fix those.\n\n\nThis patch (of 2):\n\ndamon_sysfs_scheme_filter-\u003emmecg_path can be read and written by users,\nvia DAMON sysfs memcg_path file.  It can also be indirectly read, for the\nparameters {on,off}line committing to DAMON.  The reads for parameters\ncommitting are protected by damon_sysfs_lock to avoid the sysfs files\nbeing destroyed while any of the parameters are being read.  But the\nuser-driven direct reads and writes are not protected by any lock, while\nthe write is deallocating the memcg_path-pointing buffer.  As a result,\nthe readers could read the already freed buffer (user-after-free).  Note\nthat the user-reads don\u0027t race when the same open file is used by the\nwriter, due to kernfs\u0027s open file locking.  Nonetheless, doing the reads\nand writes with separate open files would be common.  Fix it by protecting\nboth the user-direct reads and writes with damon_sysfs_lock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:55:59.503Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b1e9f2d5870776347edef927f9bb3ea19b8e3abb"
        },
        {
          "url": "https://git.kernel.org/stable/c/c88802d0e8edd14b6cd2daf3000f99adbc4c85c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/eafd6f5372d29b0dd213799b92c2c9c7ad31d7da"
        },
        {
          "url": "https://git.kernel.org/stable/c/baecc45ad60e621ef14d6c1e7f41ef36bbfdf910"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e68eb96e8beb1abefd12dd22c5637795d8a877e"
        }
      ],
      "title": "mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46121",
    "datePublished": "2026-05-28T09:35:36.292Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-06-14T17:55:59.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.