CVE-2026-46183
Use-After-Free in Linux Kernel DAMON Sysfs
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's DAMON subsystem, specifically in the handling of the 'path' parameter in sysfs-schemes. The 'path' can be read and written by users via the DAMON sysfs 'path' file. While some parameter reads are protected by a lock (damon_sysfs_lock) to prevent the sysfs files from being destroyed during access, the direct user-driven reads and writes to 'path' are not protected by any lock.
Because the write operation deallocates the buffer that the 'path' points to without locking, readers can end up reading from a buffer that has already been freed, leading to a use-after-free condition. This can happen especially when reads and writes are done through separate open files, which is common.
The fix involved protecting both the user-direct reads and writes with the damon_sysfs_lock to prevent this race condition and use-after-free scenario.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the freed memory.
Since the vulnerability involves user-controlled reads and writes to kernel memory without proper locking, it could be leveraged by a local attacker to compromise the integrity or availability of the system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability involves unprotected reads and writes to the DAMON sysfs 'path' file in the Linux kernel, which can lead to use-after-free conditions.
To mitigate this vulnerability, you should update your Linux kernel to a version where the issue is fixed by protecting both user-direct reads and writes with damon_sysfs_lock.