CVE-2026-90005 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
samples/damon/wsse: handle damon_start() failure
Patch series "samples/damon: handle damon_{start,stop}() failures".
All DAMON sample modules are not correctly handling failures from damon_start(). Among those, mtier also has an additional problem for handling of damon_stop() failures. wsse and prcl also have a problem in their damon_call() failure handling. As a result, memory leaks, next DAMON operation disruptions, and use-after-free can happen. Fix those.
Note that only the damon_start() failure caused issues can reliably be reproduced. Reproducing those issues require the admin permission, though.
This patch (of 6):
damon_sample_wsse_start() callers assume it will clean up resources when it fails. And the function does the cleanup for context buildup failures. However, it is not doing the cleanup for damon_start() failure. As a result, when damon_start() fails, it leaks the memory for DAMON context. Free the context in case of the failure to fix the issues.
Note that the issue can reliably be reproduced because the module calls damon_start() in the exclusive mode. For example,
$ sudo damo start $ echo $$ | sudo tee /sys/module/damon_sample_wsse/parameters/target_pid $ echo Y | sudo tee /sys/module/damon_sample_wsse/parameters/enabled $ sudo cat /proc/allocinfo | grep damon_new_ctx
Because the first command is running another DAMON instance, the third command fails the damon_start() call because the new DAMON instance cannot exclusively run. And without this fix, by repeating the third and the fourth commands above, we can show the memory consumption is only increasing due to the leaks. It requires the sudo permission though.
The issue was discovered [1] by Sashiko.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel vulnerability identified in the DAMON sample module wsse represents a critical resource management flaw stemming from improper error handling during subsystem initialization sequences. Specifically, the damon_sample_wsse_start function fails to release allocated memory resources when the underlying damon_start operation encounters an error condition. This deficiency arises because while the function correctly handles cleanup for context buildup failures, it neglects to perform equivalent teardown procedures if the subsequent call to damon_start returns a failure code. Consequently, any DAMON context structures that were successfully allocated prior to this point remain resident in kernel memory without being freed, leading directly to resource exhaustion over time. This type of oversight is characteristic of CWE-401, which describes missing release of resources after effective usage, and reflects a broader pattern observed across multiple DAMON sample modules where error paths are not fully instrumented for cleanup operations.
The operational impact of this vulnerability manifests primarily as kernel memory leaks that accumulate with each failed attempt to start the monitoring subsystem in exclusive mode. Because the damon_start function is invoked exclusively, concurrent attempts by other processes or administrative tools to initiate their own DAMON instances will trigger failure conditions within the wsse module. Each such failure results in the retention of allocated context structures, causing a steady increase in kernel memory consumption as verified through /proc/allocinfo metrics. Beyond simple resource leakage, this flaw introduces potential stability risks including next operation disruptions and possible use-after-free scenarios if subsequent code assumes valid state while referencing freed or improperly managed objects. The vulnerability requires administrative privileges to exploit, limiting its attack surface but increasing the severity of impact for privileged users who may inadvertently trigger repeated failures through misconfigured monitoring setups.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this issue relates to T1530 Data from Local System which could be exacerbated by memory exhaustion leading to denial-of-service conditions against kernel subsystems. The inability to properly clean up after failed initialization attempts undermines the reliability of system monitoring capabilities and can degrade overall system performance through progressive resource depletion. Security analysts should note that while direct exploitation for arbitrary code execution is not indicated, the cumulative effect of unchecked memory allocation creates a pathway for local denial-of-service attacks against kernel stability when triggered repeatedly by privileged actors or automated scripts interacting with DAMON parameters via sysfs interfaces.
Mitigation strategies involve applying the upstream patch series that addresses error handling across all affected DAMON sample modules including wsse mtier and prcl variants. System administrators should ensure their kernels are updated to versions containing these fixes which properly implement cleanup routines for damon_start failures in addition to existing context buildup failure handlers. Until patches are applied, operational procedures should avoid triggering repeated exclusive mode start attempts within the same kernel session where possible. Additionally monitoring tools tracking /proc/allocinfo metrics can help detect early signs of memory leakage associated with DAMON subsystem usage allowing administrators to identify and restart affected services before significant resource exhaustion occurs.