CVE-2026-46121 in Linux
Summary
by MITRE • 05/28/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
Patch series "mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path".
Reads of 'memcg_path' and 'path' files in DAMON sysfs interface could race with their writes, results in use-after-free. Fix those.
This patch (of 2):
damon_sysfs_scheme_filter->mmecg_path can be read and written by users, via DAMON sysfs memcg_path file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters
committing are protected by damon_sysfs_lock to avoid the sysfs files being destroyed while any of the parameters are being read. But the user-driven direct reads and writes are not protected by any lock, while the write is deallocating the memcg_path-pointing buffer. As a result, the readers could read the already freed buffer (user-after-free). Note that the user-reads don't race when the same open file is used by the writer, due to kernfs's open file locking. Nonetheless, doing the reads and writes with separate open files would be common. Fix it by protecting both the user-direct reads and writes with damon_sysfs_lock.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/25/2026
The vulnerability resides within the Linux kernel's DAMON (Dynamic Access Monitor) subsystem, specifically in the memory cgroup path handling mechanism. This issue affects the mm/damon/sysfs-schemes component where the memcg_path and path files in the DAMON sysfs interface are subject to race conditions between read and write operations. The fundamental flaw occurs when userspace applications interact with these sysfs files, creating potential for use-after-free conditions that can compromise system stability and security.
The technical implementation involves the damon_sysfs_scheme_filter structure which manages memory cgroup paths through the memcg_path field. When userspace applications write to the memcg_path file through the sysfs interface, the kernel deallocates the memory buffer pointed to by memcg_path through a kfree() operation. However, concurrent reads of the same memcg_path file can occur before or after this deallocation, resulting in access to freed memory. The existing protection mechanism only covers the indirect reads during parameter committing operations but fails to protect direct user-driven reads and writes to the sysfs files.
This vulnerability represents a classic use-after-free condition classified under CWE-416, where memory is accessed after it has been freed, potentially leading to arbitrary code execution or system crashes. The race condition specifically manifests when separate file descriptors are used for reading and writing operations, as the kernel's kernfs subsystem does not prevent concurrent access patterns that could lead to memory corruption. The attack surface extends beyond simple memory corruption to include potential privilege escalation scenarios, as the DAMON subsystem operates within kernel space and could be exploited to gain elevated privileges.
The operational impact of this vulnerability is significant for systems running Linux kernels with DAMON enabled, particularly in environments where memory cgroup monitoring and access patterns are actively managed. The race condition can occur during normal system operation when multiple processes attempt to simultaneously read and write memory cgroup path information through the sysfs interface. This creates a window where attackers could potentially trigger the use-after-free condition through carefully crafted concurrent operations, leading to system instability or denial of service conditions.
Mitigation strategies should focus on implementing proper locking mechanisms around all direct user reads and writes to the DAMON sysfs interface files. The fix involves extending the existing damon_sysfs_lock protection to cover both user-driven read and write operations on memcg_path and path files, ensuring that no memory access occurs after deallocation. System administrators should ensure that all affected kernels are updated with the patch series addressing this specific vulnerability. Additionally, monitoring for concurrent sysfs file access patterns and implementing proper resource management practices can help reduce the likelihood of exploitation. The solution aligns with ATT&CK technique T1059.003 for executing malicious code through kernel vulnerabilities and emphasizes the importance of proper memory management in kernel subsystems to prevent privilege escalation and system compromise.