CVE-2026-64184
Received Received - Intake

Memory Leak in Linux Kernel DAMON Sysfs

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() damon_sysfs_memcg_path_to_id() breaks mem_cgroup_iter() loop without calling mem_cgroup_iter_break(). This leaks the cgroup reference. Fix the issue by calling mem_cgroup_iter_break() before the break. The issue was discovered [1] by Sashiko.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64184
EUVD
EUVD-2026-45869

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a missing function call in the memory management subsystem. Specifically, the damon_sysfs_memcg_path_to_id() function breaks out of a loop without properly releasing a reference to a cgroup object. This can lead to a resource leak where the system fails to clean up memory references correctly.

Detection Guidance

This vulnerability is specific to the Linux kernel's DAMON subsystem and requires kernel-level inspection. Detection involves checking kernel logs for memory cgroup reference leaks or analyzing the damon_sysfs_memcg_path_to_id function behavior. No standard commands exist for direct detection as it requires kernel debugging tools like ftrace or custom scripts.

Impact Analysis

This vulnerability may cause memory leaks in the Linux kernel, potentially leading to system instability or reduced performance over time. It could result in resource exhaustion if the leaked references accumulate, affecting overall system operation.

Compliance Impact

This vulnerability involves a missing mem_cgroup_iter_break() call in the Linux kernel, which leaks a cgroup reference. It does not directly impact data privacy or security controls required by GDPR or HIPAA.

Mitigation Strategies

Apply the official Linux kernel patch that resolves the missing mem_cgroup_iter_break call. Update to a kernel version containing the fix. If patching is not immediately possible, restrict access to DAMON sysfs interfaces or disable DAMON functionality until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart