CVE-2026-46121: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46121 Overview

CVE-2026-46121 is a use-after-free vulnerability in the Linux kernel's Data Access MONitor (DAMON) sysfs interface. The flaw resides in mm/damon/sysfs-schemes, where reads and writes to the memcg_path file race without proper locking. A writer can free the memcg_path buffer while a concurrent reader still references it, leading to memory corruption. The kernel maintainers resolved the issue by protecting both user-driven reads and writes with damon_sysfs_lock.

Critical Impact
Local users with access to DAMON sysfs files can trigger a use-after-free in kernel memory, potentially causing kernel crashes or memory corruption that may be leveraged for privilege escalation.

Affected Products

Linux kernel branches containing the DAMON sysfs schemes interface
Distributions shipping kernels prior to the commits referenced in the upstream fix series
Systems exposing /sys/kernel/mm/damon/ to non-privileged contexts

Discovery Timeline

2026-05-28 - CVE-2026-46121 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46121

Vulnerability Analysis

The vulnerability affects the damon_sysfs_scheme_filter structure, specifically its memcg_path field. Users read and write this field through the DAMON sysfs memcg_path file. The same field is also read indirectly when parameters are committed online or offline to DAMON.

Parameter-commit reads are correctly guarded by damon_sysfs_lock, which prevents sysfs files from being destroyed during access. Direct user reads and writes, however, lack any locking. A writer can call kfree() on the memcg_path buffer while a separate file descriptor performs a concurrent read of the same pointer.

Kernfs open-file locking serializes operations on a single open file descriptor, so single-FD use does not race. The race condition only manifests when separate processes or descriptors perform the read and write simultaneously, which is a common usage pattern.

Root Cause

The root cause is missing synchronization between sysfs read and write handlers for the memcg_path attribute. The write path deallocates the heap buffer holding the path string, while concurrent readers still dereference the freed memory. This is a classic use-after-free [CWE-416] caused by inconsistent locking discipline across access paths to the same shared object.

Attack Vector

Exploitation requires local access and the ability to open and write the DAMON sysfs memcg_path file. An attacker triggers the race by opening two file descriptors against the attribute and issuing concurrent read and write operations. Successful exploitation yields read access to freed kernel slab memory, with potential for further memory corruption depending on slab reuse patterns. The fix series, applied across multiple stable branches via commits 1e68eb96, b1e9f2d5, baecc45a, c88802d0, and eafd6f53, acquires damon_sysfs_lock on the user-facing read and write paths.

No verified exploit code is publicly available. See the Kernel Git Commit 1e68eb96 and Kernel Git Commit eafd6f53 for the patch details.

Detection Methods for CVE-2026-46121

Indicators of Compromise

Kernel oops or panic messages referencing damon_sysfs_scheme_filter or memcg_path in dmesg output
KASAN reports flagging use-after-free in mm/damon/sysfs-schemes.c
Unexpected process termination or kernel logs from workloads interacting with /sys/kernel/mm/damon/

Detection Strategies

Enable KASAN on test and staging kernels to surface the use-after-free condition during fuzzing or stress testing
Audit kernel versions across the fleet against the upstream stable commits that introduce the locking fix
Inspect process activity for non-root users writing to DAMON sysfs paths, which is uncommon in production workloads

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized SIEM and alert on damon or KASAN: use-after-free strings
Track sysfs file access auditd rules covering /sys/kernel/mm/damon/ for write events from unexpected UIDs
Monitor kernel package versions through configuration management to confirm patched builds are deployed

How to Mitigate CVE-2026-46121

Immediate Actions Required

Update the Linux kernel to a version containing the upstream fix series for mm/damon/sysfs-schemes
Restrict access to DAMON sysfs files to the root user only on systems where DAMON is enabled
Disable the DAMON subsystem on hosts that do not require memory access monitoring

Patch Information

The fix is distributed across stable kernel branches in commits 1e68eb96, b1e9f2d5, baecc45a, c88802d0, and eafd6f53. Each commit wraps the memcg_path read and write handlers with damon_sysfs_lock to eliminate the race. Apply the distribution-provided kernel update that incorporates these patches and reboot affected hosts.

Workarounds

Tighten permissions on /sys/kernel/mm/damon/ so that only privileged service accounts can read or write the attribute
Build kernels without CONFIG_DAMON_SYSFS where the feature is not required
Use Linux capability restrictions or seccomp profiles to prevent unprivileged workloads from opening DAMON sysfs files

bash

# Restrict DAMON sysfs access to root
chmod -R o-rwx /sys/kernel/mm/damon/
chown -R root:root /sys/kernel/mm/damon/

# Verify running kernel version after patching
uname -r