CVE-2026-46087 Overview
CVE-2026-46087 is a memory leak vulnerability in the Linux kernel's Data Access Monitor (DAMON) statistics subsystem. The flaw resides in the damon_stat_start() function within mm/damon/stat. When damon_start() fails, the code does not destroy the previously allocated DAMON context or reset the global damon_stat_context pointer. The context allocated by damon_stat_build_ctx() is leaked, and the stale pointer is overwritten on the next enable attempt, making the original allocation permanently unreachable.
Critical Impact
Repeated failed enable attempts of DAMON statistics can exhaust kernel memory through cumulative leaks, degrading system stability over time.
Affected Products
- Linux kernel versions containing the mm/damon/stat subsystem prior to the fix
- Distributions shipping affected stable kernel branches referenced in the upstream patches
- Systems with DAMON memory monitoring enabled
Discovery Timeline
- 2026-05-27 - CVE-2026-46087 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46087
Vulnerability Analysis
The vulnerability exists in the DAMON statistics initialization path in the Linux kernel memory management subsystem. DAMON (Data Access MONitor) provides operating system level memory access pattern monitoring. The damon_stat_start() function allocates a DAMON context via damon_stat_build_ctx() and then calls damon_start() to begin monitoring.
When damon_start() returns an error, the cleanup path is incomplete. The allocated context is neither destroyed nor disassociated from the global pointer damon_stat_context. On a subsequent enable attempt, the global pointer is overwritten with a newly allocated context, orphaning the previous allocation. This produces an unreachable memory region inside the kernel address space.
Root Cause
The root cause is missing error-path cleanup in damon_stat_start(). The function lacks a call to destroy the DAMON context and to reset damon_stat_context to NULL when damon_start() fails. This is a memory management defect categorized as a Memory Leak in kernel code.
Attack Vector
Triggering the leak requires privileged interaction with the DAMON statistics interface, typically through sysfs controls that toggle the feature. An actor able to repeatedly fail the enable operation can accumulate leaked kernel allocations. The vulnerability does not provide direct code execution or information disclosure. It impacts availability by consuming kernel memory resources over time.
The vulnerability mechanism is described in the upstream commits. See the Git Kernel Patch 50bc1d7e, Git Kernel Patch 8a62c584, and Git Kernel Patch e04ed278 for the exact source changes.
Detection Methods for CVE-2026-46087
Indicators of Compromise
- Gradual reduction in available kernel memory (MemFree, SReclaimable) without a corresponding workload increase
- Repeated failures in kernel logs related to DAMON enable attempts or damon_start() errors
- Unexpected growth in slab allocations attributable to DAMON context structures
Detection Strategies
- Audit kernel versions against the fixed commits referenced in the upstream stable tree
- Monitor /sys/kernel/mm/damon/ interactions and correlate with kernel error returns
- Inspect /proc/slabinfo for abnormal growth in DAMON-related caches on long-running hosts
Monitoring Recommendations
- Track kernel memory consumption baselines on hosts where DAMON statistics are enabled
- Alert on repeated EBUSY or error returns from DAMON sysfs writes
- Centralize kernel logs and review for damon_stat_start warnings or related stack traces
How to Mitigate CVE-2026-46087
Immediate Actions Required
- Apply the upstream stable kernel patches that destroy the context and reset the pointer on failure
- Identify hosts running affected kernels and prioritize those with DAMON statistics enabled
- Disable DAMON statistics on systems that do not require the feature until patches are applied
Patch Information
Three upstream commits fix the issue across stable branches: Git Kernel Patch 50bc1d7e, Git Kernel Patch 8a62c584, and Git Kernel Patch e04ed278. The fix destroys the DAMON context allocated by damon_stat_build_ctx() and resets the global damon_stat_context pointer when damon_start() returns an error.
Workarounds
- Avoid repeatedly toggling DAMON statistics on unpatched kernels
- Restrict access to DAMON sysfs interfaces to trusted administrators
- Reboot hosts exhibiting kernel memory pressure attributable to repeated failed DAMON enable attempts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
