CVE-2026-64184: Linux Kernel Information Disclosure Bug

CVE-2026-64184 Overview

CVE-2026-64184 is a resource management flaw in the Linux kernel's Data Access MONitor (DAMON) sysfs interface. The function damon_sysfs_memcg_path_to_id() breaks out of a mem_cgroup_iter() iteration loop without calling the corresponding mem_cgroup_iter_break(). This omission leaks a memory cgroup (memcg) reference each time the affected path executes. Over time, leaked references prevent proper cleanup of cgroup structures, contributing to kernel memory pressure and unreliable cgroup teardown. The upstream fix inserts the missing mem_cgroup_iter_break() call before the loop exits.

Critical Impact
Repeated invocation of the affected DAMON sysfs path leaks memory cgroup references, degrading system stability and preventing memcg reclamation on long-running Linux hosts.

Affected Products

Linux kernel builds including DAMON sysfs schemes support (mm/damon/sysfs-schemes)
Distributions shipping affected mainline and stable kernel branches prior to the fix commits
Systems where memory cgroup accounting is enabled and DAMON is exposed via sysfs

Discovery Timeline

2026-07-19 - CVE-2026-64184 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64184

Vulnerability Analysis

DAMON is the Linux kernel's Data Access MONitor subsystem, which provides operation schemes controllable through sysfs. One helper, damon_sysfs_memcg_path_to_id(), walks all memory cgroups using the mem_cgroup_iter() iterator to resolve a supplied cgroup path to an internal identifier. The iterator API requires that any early exit from the loop be paired with a call to mem_cgroup_iter_break() so that the reference taken on the current iterated mem_cgroup is released.

The affected implementation used a plain break statement to exit the loop once a matching path was found, skipping the required cleanup call. Each successful lookup therefore leaves one memory cgroup reference count elevated for the lifetime of the kernel.

Root Cause

The root cause is an API contract violation in mm/damon/sysfs-schemes. The mem_cgroup_iter() and mem_cgroup_iter_break() pair implements reference-counted iteration over the memcg hierarchy. Omitting mem_cgroup_iter_break() on early exit produces a memory leak of the cgroup reference, classified as a resource leak in kernel accounting code.

Attack Vector

Exploitation requires local access to the DAMON sysfs interface, which is typically restricted to privileged users. A user or process able to write memcg paths into DAMON scheme sysfs attributes can repeatedly trigger the leaking code path. The vulnerability does not grant code execution or privilege escalation. The observable impact is exhaustion of memcg objects and degraded reclaim behavior over time, consistent with a denial-of-service class issue.

The upstream patch adds the missing mem_cgroup_iter_break() call before the loop exit. See the fix commits referenced by the Linux stable tree, including Kernel Git Commit 30a361b and Kernel Git Commit d4e7b5c.

Detection Methods for CVE-2026-64184

Indicators of Compromise

Growing count of mem_cgroup slab objects reported by /proc/slabinfo on hosts using DAMON with memcg-based schemes.
Cgroup directories that cannot be removed after workloads exit, with residual reference counts visible in /sys/fs/cgroup.
Repeated writes to DAMON sysfs attributes referencing memcg paths under /sys/kernel/mm/damon/admin/kdamonds/.

Detection Strategies

Compare running kernel version and build metadata against the fix commits listed in the Linux stable tree references.
Track kernel memory accounting metrics for unexpected growth in memcg-related allocations on hosts running DAMON schemes.
Audit which processes and users have write access to DAMON sysfs attributes that accept cgroup paths.

Monitoring Recommendations

Ingest kernel version inventory and slab statistics into a centralized data lake for longitudinal comparison across the fleet.
Alert on repeated writes to DAMON sysfs paths from non-administrative accounts.
Correlate reports of unreclaimed cgroups with DAMON scheme configuration changes.

How to Mitigate CVE-2026-64184

Immediate Actions Required

Identify Linux hosts running kernels that predate the DAMON mem_cgroup_iter_break() fix commits.
Restrict write access to DAMON sysfs attributes to trusted administrators only.
Schedule kernel updates to a version that includes the referenced stable fix commits.

Patch Information

The fix is available in the Linux stable tree via multiple backport commits, including Kernel Git Commit 082351f, Kernel Git Commit 1bd3138, Kernel Git Commit 302e02f, Kernel Git Commit 30a361b, and Kernel Git Commit d4e7b5c. Apply the vendor kernel package that includes these commits and reboot.

Workarounds

Disable the DAMON sysfs interface on hosts that do not require it by not enabling CONFIG_DAMON_SYSFS in custom kernels.
Remove or tighten permissions on /sys/kernel/mm/damon/ so unprivileged users cannot submit memcg paths.
Periodically reboot long-running hosts using vulnerable kernels to reclaim leaked memcg references until a patched kernel is deployed.

bash

# Verify running kernel and DAMON sysfs exposure
uname -r
ls -l /sys/kernel/mm/damon/admin/kdamonds/ 2>/dev/null

# Restrict access to DAMON sysfs (example)
chmod -R o-rwx /sys/kernel/mm/damon/