CVE-2026-46121

Technical summary

CVE-2026-46121 is a use-after-free (CWE-416) flaw in mm/damon/sysfs-schemes affecting the damon_sysfs_scheme_filter structure's memcg_path field. The vulnerability arises from inadequate synchronization between user-space reads and writes via the DAMON sysfs interface. While parameter commits to DAMON are protected by damon_sysfs_lock, direct user-driven sysfs file operations on memcg_path lack lock protection. A write operation deallocates the buffer pointed to by memcg_path without serialization, enabling concurrent reads to dereference freed memory. The kernfs per-file-handle locking prevents races when the same open file descriptor is used, but separate file handles from different processes bypass this protection.

Business impact

This vulnerability could allow local privileged users (with write access to DAMON sysfs files) to trigger kernel memory corruption, leading to denial of service through system crashes or unexpected behavior. While the attack surface is somewhat limited to systems with DAMON enabled and accessible sysfs controls, the HIGH CVSS score (7.8) reflects the combination of local privilege requirement and potential for confidentiality and integrity impact beyond availability. Organizations running custom kernel configurations or containerized workloads that leverage DAMON for monitoring face elevated risk.

Affected systems

All Linux kernel versions containing the DAMON sysfs-schemes subsystem are affected. This includes mainstream distributions and custom kernels where DAMON is compiled in (CONFIG_DAMON_SYSFS). The vulnerability is particularly relevant to systems using kernel-based workload monitoring, performance analysis tools that interface with DAMON, or containerized environments where memory cgroup management is active.

Exploitability

Exploitation requires local access with privileges sufficient to write to DAMON sysfs interface files, typically requiring unprivileged or local user status depending on file permissions. The race condition is deterministic if attackers can coordinate concurrent read and write operations on the memcg_path file descriptor. No complex exploitation techniques or specific timing windows are documented as required; the underlying flaw is inherent to the unsynchronized access pattern. This vulnerability is not currently tracked in the CISA KEV catalog.

Remediation

The fix involves wrapping both user-direct reads and writes to the memcg_path file with damon_sysfs_lock mutual exclusion, ensuring that memory deallocation and access are serialized. This aligns the sysfs file operations with the locking already applied to parameter commits. Organizations should prioritize patching kernel versions post-fix to eliminate the race condition.

Patch guidance

Verify the Linux kernel advisory or your distribution's security bulletin for patched versions addressing CVE-2026-46121. Apply kernel updates as they become available from your vendor. If kernel recompilation is performed in-house, ensure damon_sysfs_lock protection is applied to both read and write paths of the memcg_path handling code. Test patched kernels in non-production environments before broad deployment to confirm DAMON functionality remains intact.

Detection guidance

Monitor system logs for kernel warnings or crashes related to DAMON sysfs operations, particularly memory access violations or use-after-free detector output if KASAN (Kernel Address Sanitizer) is enabled. Audit access patterns to /sys/kernel/debug/damon/ sysfs paths, looking for concurrent read-write operations on memcg_path files from different processes. Kernel crash dumps indicating freed memory dereference in DAMON code paths are potential indicators of exploitation attempts.

Why prioritize this

Although this flaw requires local access and is not yet widely exploited (absent from KEV), the HIGH CVSS score and the widespread nature of Linux kernel deployments make timely patching important. Organizations with DAMON-dependent workloads, strict kernel hardening policies, or multi-tenant systems where user isolation is critical should prioritize this patch. Systems without DAMON enabled face negligible risk and can defer patching to regular maintenance cycles.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L), low attack complexity (AC:L), requiring low privilege (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score accurately captures the kernel-level memory corruption potential and the consequence of a successful exploit, balanced against the local-only access requirement.

Frequently asked questions