CVE-2025-38258 in Linux
Summary
by MITRE • 07/09/2025
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
memcg_path_store() assigns a newly allocated memory buffer to filter->memcg_path, without deallocating the previously allocated and assigned memory buffer. As a result, users can leak kernel memory by continuously writing a data to memcg_path DAMOS sysfs file. Fix the leak by deallocating the previously set memory buffer.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/02/2026
This vulnerability exists in the Linux kernel's DAMON (Dynamic Access Monitor) subsystem, specifically within the memory cgroup path handling mechanism. The issue is classified as a memory leak in the mm/damon/sysfs-schemes component where the memcg_path_store() function fails to properly manage memory allocation and deallocation. When users write data to the memcg_path DAMOS sysfs file, the system allocates new memory buffers to store the path information but does not free the previously allocated memory, creating a persistent memory leak that can accumulate over time.
The technical flaw stems from improper memory management practices within the kernel's sysfs interface implementation. The memcg_path_store() function receives new data through the sysfs file interface and assigns it to filter->memcg_path without first checking if the memory buffer was already allocated or properly freeing it. This violates fundamental memory management principles and creates a classic resource leak scenario where kernel memory becomes permanently unavailable for reuse. The vulnerability is particularly concerning because it operates within kernel space, meaning the memory leak can accumulate to significant levels and potentially impact system stability or performance.
The operational impact of this vulnerability extends beyond simple memory consumption issues. While the immediate effect is a memory leak, the cumulative nature of the leak can lead to system resource exhaustion, particularly on systems with high memory usage patterns or those running for extended periods. Attackers could potentially exploit this vulnerability to cause denial of service conditions by continuously writing to the memcg_path sysfs file, gradually consuming kernel memory resources. The vulnerability aligns with CWE-401, which specifically addresses memory leaks in software systems, and represents a critical weakness in kernel memory management that could be leveraged to degrade system performance or availability.
Mitigation strategies for this vulnerability should focus on implementing proper memory deallocation mechanisms within the kernel codebase. The fix requires ensuring that when memcg_path_store() receives new data, it first frees any previously allocated memory before assigning new allocations. This approach follows the established principle of "free before allocate" in kernel programming and aligns with the ATT&CK technique T1499.004 for resource exhaustion attacks. System administrators should ensure timely kernel updates that include the patched version of the DAMON subsystem, while monitoring for unusual memory consumption patterns that might indicate exploitation attempts. The vulnerability demonstrates the importance of proper memory management in kernel space and highlights the need for thorough code review processes when implementing sysfs interfaces that handle dynamic memory allocation.