CVE-2026-64184

Analyzed Analyzed - Analysis Complete

Memory Leak in Linux Kernel DAMON Sysfs

Publication date: 2026-07-19

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() damon_sysfs_memcg_path_to_id() breaks mem_cgroup_iter() loop without calling mem_cgroup_iter_break(). This leaks the cgroup reference. Fix the issue by calling mem_cgroup_iter_break() before the break. The issue was discovered [1] by Sashiko.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-11

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64184

EUVD

EUVD-2026-45869

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.3 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing function call in the memory management subsystem. Specifically, the damon_sysfs_memcg_path_to_id() function breaks out of a loop without properly releasing a reference to a cgroup object. This can lead to a resource leak where the system fails to clean up memory references correctly.

Detection Guidance

This vulnerability is specific to the Linux kernel's DAMON subsystem and requires kernel-level inspection. Detection involves checking kernel logs for memory cgroup reference leaks or analyzing the damon_sysfs_memcg_path_to_id function behavior. No standard commands exist for direct detection as it requires kernel debugging tools like ftrace or custom scripts.

Impact Analysis

This vulnerability may cause memory leaks in the Linux kernel, potentially leading to system instability or reduced performance over time. It could result in resource exhaustion if the leaked references accumulate, affecting overall system operation.

Compliance Impact

This vulnerability involves a missing mem_cgroup_iter_break() call in the Linux kernel, which leaks a cgroup reference. It does not directly impact data privacy or security controls required by GDPR or HIPAA.

Mitigation Strategies

Apply the official Linux kernel patch that resolves the missing mem_cgroup_iter_break call. Update to a kernel version containing the fix. If patching is not immediately possible, restrict access to DAMON sysfs interfaces or disable DAMON functionality until the patch is applied.

Hi! I’m here to help you understand CVE-2026-64184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70