CVE-2026-23144: Linux Kernel DAMON Sysfs DoS Vulnerability

CVE-2026-23144 Overview

CVE-2026-23144 is a Linux kernel vulnerability in the Data Access Monitor (DAMON) sysfs interface. The flaw resides in mm/damon/sysfs and triggers when a context DAMON sysfs directory setup fails after the attrs/ directory has already been created. Subdirectories under attrs/ are not cleaned up, leaving the DAMON sysfs interface in a broken state until the system reboots. The unremoved directories also leak kernel memory. A local authenticated user interacting with the DAMON sysfs interface can trigger the condition, resulting in denial of service against the memory monitoring subsystem.

Critical Impact
Failure paths in DAMON sysfs context setup leave stale attribute subdirectories, breaking the DAMON interface and leaking kernel memory until reboot.

Affected Products

Linux Kernel 6.19-rc1
Linux Kernel 6.19-rc2 through 6.19-rc5
Earlier kernel branches receiving stable backports (see kernel.org patch references)

Discovery Timeline

2026-02-14 - CVE-2026-23144 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-23144

Vulnerability Analysis

DAMON (Data Access Monitor) is a Linux kernel subsystem that monitors data access patterns of running processes. It exposes a sysfs interface for user-space configuration, organized as a hierarchy of directories representing contexts, attributes, targets, and schemes.

When user space initiates the creation of a DAMON context directory, the kernel sequentially sets up child directories, including the attrs/ directory and its subdirectories. If a later step in the context directory setup fails, the cleanup path did not unwind the previously created attrs/ subdirectories. The partial state persists for the lifetime of the running kernel.

Two consequences follow. First, the DAMON sysfs interface enters a broken state because stale kobjects remain registered, preventing further successful operations until reboot. Second, memory allocated for the orphaned subdirectory kobjects is leaked. The issue is classified under [CWE-noinfo] by NVD.

Root Cause

The root cause is incomplete error handling in the DAMON sysfs context directory setup routine. The function allocated and registered attrs/ subdirectories but lacked a corresponding teardown path when a subsequent allocation or registration failed. The fix introduces proper cleanup of attribute subdirectories on the failure path.

Attack Vector

Exploitation requires local access with privileges sufficient to interact with the DAMON sysfs interface, typically located under /sys/kernel/mm/damon/. An attacker who can reliably induce setup failures (for example, by exhausting memory or racing concurrent operations) can repeatedly trigger the leak and disable the DAMON subsystem. The attack vector is local with low complexity and low privileges required, and the impact is limited to availability.

No public proof-of-concept exploit, exploit-database entry, or CISA KEV listing exists for this issue. Refer to the upstream commits for the precise code paths involved, including Kernel Patch 43964644348f and Kernel Patch 78b4eb99751e.

Detection Methods for CVE-2026-23144

Indicators of Compromise

DAMON sysfs operations under /sys/kernel/mm/damon/admin/kdamonds/*/contexts/ failing repeatedly or returning errors despite valid input.
Growing unreclaimable kernel memory in slabinfo entries associated with kobject and kernfs_node allocations following DAMON usage.
Inability to create new DAMON contexts or remove existing ones without a system reboot.

Detection Strategies

Audit kernel logs (dmesg, journalctl -k) for warnings during DAMON sysfs operations and for kmemleak reports referencing DAMON code paths.
Compare installed kernel versions against the fixed commits listed in the kernel.org stable references to identify unpatched hosts.
Monitor user-space processes invoking writes to DAMON sysfs paths under elevated privileges to identify potentially abusive workloads.

Monitoring Recommendations

Enable CONFIG_DEBUG_KMEMLEAK on test kernels to surface memory leaks originating in mm/damon/sysfs.
Track kernel package inventory and patch level across the Linux fleet using a centralized telemetry pipeline.
Alert on anomalous local activity against /sys/kernel/mm/damon/ paths by unexpected user accounts or service identities.

How to Mitigate CVE-2026-23144

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream fix backported through the stable trees referenced by the kernel.org commits.
Restrict access to the DAMON sysfs interface to root and trusted administrators using filesystem permissions and Mandatory Access Control policies.
Audit local accounts on multi-tenant systems and remove unnecessary shell access to limit the population of users who can trigger the bug.

Patch Information

The vulnerability is resolved by the following upstream commits, which add cleanup of attrs/ subdirectories when context directory setup fails: Kernel Patch 43964644348f, Kernel Patch 5651c0c391c, Kernel Patch 78b4eb99751e, Kernel Patch 9814cc832b, and Kernel Patch db7dfe78fc81. Apply the corresponding distribution updates as soon as they become available.

Workarounds

Disable the DAMON subsystem at boot by not enabling CONFIG_DAMON_SYSFS in custom kernels where the feature is not required.
Remount or restrict permissions on /sys/kernel/mm/damon/ so that only privileged administrators can write to the interface.
Avoid running automation that repeatedly creates and tears down DAMON contexts under memory pressure on unpatched kernels.

bash

# Verify kernel version and DAMON sysfs exposure
uname -r
ls -l /sys/kernel/mm/damon/admin/kdamonds/ 2>/dev/null

# Restrict access to DAMON sysfs to root only
chmod -R o-rwx /sys/kernel/mm/damon/ 2>/dev/null

# Confirm patched kernel package is installed (Debian/Ubuntu example)
dpkg -l | grep linux-image

# Confirm patched kernel package is installed (RHEL/CentOS example)
rpm -qa | grep kernel