CVE-2026-23142: Linux Kernel Information Disclosure Flaw

CVE-2026-23142 Overview

CVE-2026-23142 is a Linux kernel vulnerability in the Data Access MONitor (DAMON) sysfs scheme interface. When DAMOS-scheme directory setup fails after the access_pattern/ directory is created, the subdirectories under access_pattern/ are not properly cleaned up. The result is a memory leak and a near-unusable DAMON sysfs interface that persists until system reboot. The flaw affects local users with access to the DAMON sysfs interface and can trigger an availability impact on the kernel subsystem.

Critical Impact
Local attackers with sysfs access can leak kernel memory and render the DAMON sysfs interface inoperative until reboot, degrading system availability.

Affected Products

Linux kernel 6.19-rc1 through 6.19-rc5
Linux kernel stable branches prior to the fix commits
Systems using DAMON sysfs interface with DAMOS schemes configured

Discovery Timeline

2026-02-14 - CVE-2026-23142 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-23142

Vulnerability Analysis

The vulnerability resides in mm/damon/sysfs-scheme.c, which manages the sysfs interface for DAMON Operation Schemes (DAMOS). DAMON is the kernel's Data Access Monitoring framework used to observe memory access patterns and apply schemes such as page reclamation or migration. The sysfs interface exposes scheme parameters through a hierarchy of directories including access_pattern/.

When the kernel allocates the scheme directory hierarchy, it first creates the access_pattern/ directory and then populates its subdirectories. If a later step in the parent scheme directory setup fails, the existing subdirectories under access_pattern/ remain allocated. The kernel does not invoke the corresponding teardown path on this error branch, leaving orphaned sysfs nodes and leaking the underlying kernel memory.

This incomplete error handling has two consequences. First, repeated failures progressively consume kernel memory through unfreed directory state. Second, the stale entries leave the DAMON sysfs interface in an inconsistent state, preventing further valid scheme configuration until the system is rebooted.

Root Cause

The root cause is an unhandled cleanup path on scheme directory setup failure. The function that constructs the scheme sysfs hierarchy returns an error after access_pattern/ subdirectory setup without unwinding the partially constructed state. This is a classic resource cleanup ordering bug in kernel error handling.

Attack Vector

Exploitation requires local access with privileges sufficient to interact with the DAMON sysfs interface, typically under /sys/kernel/mm/damon/. An attacker triggers a scheme setup failure repeatedly to leak kernel memory and disrupt the sysfs interface. The vulnerability does not provide code execution or information disclosure but produces a denial-of-service condition affecting the DAMON subsystem and contributing to kernel memory pressure.

No public exploit code or proof-of-concept has been published. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. See the upstream kernel fix in commit 16236b0b4a08 for the cleanup logic.

Detection Methods for CVE-2026-23142

Indicators of Compromise

Persistent stale entries under /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/schemes/*/access_pattern/ after failed scheme configuration attempts
Unexplained growth in kernel slab memory attributable to kobject or sysfs directory allocations
DAMON sysfs writes returning errors with no path to recover without reboot

Detection Strategies

Monitor kernel logs for repeated DAMON scheme setup failures originating from mm/damon/sysfs-scheme.c
Track kernel memory consumption over time on hosts where DAMON is enabled and look for unexpected upward trends
Audit local processes and users writing to DAMON sysfs paths, especially in environments where DAMON is not actively managed

Monitoring Recommendations

Collect /proc/slabinfo and /proc/meminfo samples on DAMON-enabled hosts to baseline kernel memory use
Forward dmesg and audit logs to a centralized analytics platform to correlate sysfs access with kernel warnings
Alert on any non-administrative user account interacting with /sys/kernel/mm/damon/ paths

How to Mitigate CVE-2026-23142

Immediate Actions Required

Apply the upstream kernel patches referenced below or upgrade to a kernel build that includes the fix
Restrict write access to /sys/kernel/mm/damon/ to trusted administrative accounts only
Disable the DAMON sysfs interface on systems that do not require it by removing CONFIG_DAMON_SYSFS or by not loading DAMON

Patch Information

The upstream fix adds cleanup of access_pattern/ subdirectories on scheme directory setup failure. The fix is distributed across multiple stable branches in the following commits: Kernel Patch Commit 16236b0, Kernel Patch Commit 392b3d9, Kernel Patch Commit 725d4fd, Kernel Patch Commit ae8ac00, and Kernel Patch Commit e9711bd.

Workarounds

Tighten Discretionary Access Control on the DAMON sysfs hierarchy so only root or a dedicated service account can write to it
Use Linux Security Modules such as SELinux or AppArmor to confine processes from interacting with DAMON sysfs paths
Avoid running automation that programmatically configures DAMON schemes on unpatched hosts to reduce the chance of triggering the failure path

bash

# Restrict access to the DAMON sysfs interface on unpatched hosts
chown -R root:root /sys/kernel/mm/damon
chmod -R go-rwx /sys/kernel/mm/damon

# Verify the running kernel version includes the fix
uname -r