CVE-2026-64239 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
DAMON sysfs maintains the DAMOS tried region directory objects via a linked list. When the user requests refresh of the directories, DAMON sysfs removes all the region directories first, and then generate updated regions directory on the empty space. The removal function (damon_sysfs_scheme_regions_rm_dirs()) only puts the kobj objects. Deletion of the container region object from the linked list is done inside the kobj release callback function.
If somehow the callback invocation is delayed, the list will contain regions list that gonna be freed. If the updated region directories creation is started in this situation, the list can be corrupted and use-after-free can happen.
Because the kobj objects are managed by only DAMON sysfs, the issue cannot happen in normal situation. But, such delays can be made on kernels that built with CONFIG_DEBUG_KOBJECT_RELEASE. On the kernel, the issue can indeed be reproduced like below.
# damo start --damos_action stat # cd /sys/kernel/mm/damon/admin/kdamonds/0/ # for i in {1..10}; do echo update_schemes_tried_regions > state; done
# dmesg | grep underflow [ 89.296152] refcount_t: underflow; use-after-free.
Fix the issue by removing the region object from the list when decrementing the reference count.
Also update damos_sysfs_populate_region_dir() to add the region object to the list only after the kobject_init_and_add() is success, so that fail of kobject_init_and_add() is not leaving the deallocated object on the list.
The issue was discovered [1] by Sashiko.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides within the Linux kernel's DAMON (Dynamic Access Monitor) subsystem, specifically in the sysfs interface implementation for managing DAMOS (DAMON Access Schemes) tried regions. This flaw manifests as a use-after-free condition that can occur during the dynamic refresh of region directory objects within the DAMON sysfs framework. The issue stems from improper synchronization between object reference counting and linked list management during the removal and recreation process of region directory entries, creating a window where stale references persist in memory structures.
The technical implementation flaw involves the damon_sysfs_scheme_regions_rm_dirs() function which handles cleanup of existing region directories by only decrementing kobject reference counts without immediately removing the corresponding container objects from the linked list. This design creates a race condition where the kernel's object release callback function, which should handle the actual list removal, may be delayed due to kernel configuration settings such as CONFIG_DEBUG_KOBJECT_RELEASE. When this delay occurs, the linked list maintains references to already freed memory regions, leading to potential corruption when new region directories are created during this interim period.
The operational impact of this vulnerability is significant for systems running kernels with debugging features enabled, particularly those utilizing DAMON for memory access monitoring and optimization. The use-after-free condition can result in system instability, kernel panics, or potentially exploitable memory corruption that could allow privilege escalation attacks. While the vulnerability cannot be triggered under normal kernel operation conditions, it becomes reproducible when specific kernel debug configurations are active, making it a concern for security researchers and system administrators who enable comprehensive debugging features for troubleshooting purposes.
The fix implements proper synchronization between reference counting and list management by removing region objects from the linked list during reference count decrement rather than deferring this operation to the kobject release callback. Additionally, the damos_sysfs_populate_region_dir() function was updated to ensure that region objects are only added to the linked list after successful completion of kobject_init_and_add() operations, preventing scenarios where failed object initialization could leave dangling references in memory structures. This remediation aligns with common security practices for managing reference-counted objects and prevents the specific conditions outlined in CWE-415 and CWE-416 vulnerability categories that relate to double-free and use-after-free errors in kernel memory management.
The vulnerability demonstrates characteristics consistent with ATT&CK technique T1068, which involves privilege escalation through exploitation of kernel vulnerabilities. The issue was discovered by security researcher Sashiko, highlighting the importance of comprehensive testing of kernel subsystems under various configuration scenarios. The fix ensures that object lifecycle management follows proper sequential operations where resource allocation precedes list insertion and deallocation occurs in appropriate synchronization with reference counting operations, thereby preventing the memory corruption patterns that could be exploited for unauthorized system access or denial of service conditions.