CVE-2026-46183 Overview
CVE-2026-46183 is a use-after-free vulnerability in the Linux kernel's DAMON (Data Access MONitor) sysfs interface. The flaw resides in mm/damon/sysfs-schemes where the damon_sysfs_quot_goal->path buffer can be read and written concurrently through the DAMON sysfs path file. User-driven reads and writes occur without lock protection, while a write deallocates the path-pointing buffer. A concurrent reader can access the freed buffer, producing a use-after-free condition. The upstream fix protects both direct reads and writes with damon_sysfs_lock.
Critical Impact
Local users with access to the DAMON sysfs path file can trigger a kernel use-after-free, leading to potential information disclosure or memory corruption in the kernel address space.
Affected Products
- Linux kernel versions containing the DAMON sysfs schemes implementation in mm/damon/sysfs-schemes
- Distributions shipping vulnerable upstream kernels prior to the fix commits
- Systems exposing DAMON sysfs interfaces to non-root or unprivileged user contexts
Discovery Timeline
- 2026-05-28 - CVE-2026-46183 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46183
Vulnerability Analysis
The vulnerability is a race condition leading to a use-after-free in the DAMON sysfs schemes subsystem. The damon_sysfs_quot_goal structure contains a path field representing a heap-allocated buffer that backs the DAMON sysfs path file. Userspace can read this value, write a new value, or trigger indirect reads when committing parameters to a running DAMON instance.
Reads performed during parameter commit (on/offline committing) are serialized using damon_sysfs_lock, preventing concurrent destruction of the sysfs files during access. However, direct user-driven reads and writes to the path file bypass this lock. A write path deallocates the previous buffer with kfree() and replaces the pointer, while a concurrent reader through a different open file descriptor dereferences the freed memory.
Root Cause
The root cause is inconsistent locking. The write handler frees the existing path buffer before assigning a new allocation, but no synchronization primitive protects readers using a separate open file descriptor. Kernfs serializes operations on the same open file, which masks the issue in single-descriptor scenarios but does not extend across distinct file handles.
Attack Vector
Exploitation requires local access to the system and the ability to open the DAMON sysfs path file. An attacker opens two file descriptors against the same path node, issues a write from one while issuing a read from the other, and races the kfree() against the read. Successful races can disclose freed kernel memory contents or, with heap grooming, enable type confusion in adjacent allocations.
No verified public exploit code is available. Technical details are described in the upstream commits referenced in the Kernel Git Commit (a34ca3e3) and Kernel Git Commit (cf3b7142).
Detection Methods for CVE-2026-46183
Indicators of Compromise
- Unexpected kernel oops, KASAN reports, or panic messages referencing damon_sysfs_quot_goal or mm/damon/sysfs-schemes
- Repeated concurrent open, read, and write operations against /sys/kernel/mm/damon/admin/.../path files from non-administrative processes
- Slab corruption warnings or use-after-free detections from KASAN-enabled kernels touching DAMON allocations
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test or canary systems to surface use-after-free conditions in DAMON code paths
- Audit auditd or eBPF telemetry for processes opening DAMON sysfs files with O_RDWR from unexpected user contexts
- Correlate kernel ring buffer messages with process activity to identify race attempts against the path file
Monitoring Recommendations
- Monitor access patterns to /sys/kernel/mm/damon/ paths and alert on writes from non-root or non-administrative service accounts
- Track kernel crash and oops counters across the fleet to detect anomalous spikes after exposure of DAMON interfaces
- Log dmesg output centrally and parse for KASAN, slab, or DAMON-related fault signatures
How to Mitigate CVE-2026-46183
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits a34ca3e33da4b924c66bcca3729bf68ec5936910 and cf3b71421ca00807328c6d9cd242f9de3b77a4bf
- Restrict access to the DAMON sysfs interface to trusted administrative users only
- Track distribution security advisories for backported fixes on long-term-support kernel branches
Patch Information
The fix protects both user-driven direct reads and writes of damon_sysfs_quot_goal->path with damon_sysfs_lock, eliminating the race against kfree(). Patch details are available in the Kernel Git Commit (a34ca3e3) and Kernel Git Commit (cf3b7142).
Workarounds
- Disable the DAMON subsystem by building kernels without CONFIG_DAMON_SYSFS where the feature is not required
- Tighten file permissions on /sys/kernel/mm/damon/ to remove access from non-root users and containers
- Apply mandatory access control policies (SELinux, AppArmor) restricting write and open on DAMON sysfs nodes to administrative domains
# Configuration example: restrict DAMON sysfs access to root only
chmod -R o-rwx /sys/kernel/mm/damon/
chmod -R g-rwx /sys/kernel/mm/damon/
# Verify kernel version after patching
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
