CVE-2026-64239: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64239 Overview

CVE-2026-64239 is a use-after-free vulnerability in the Linux kernel's DAMON (Data Access MONitor) sysfs interface. The flaw exists in the mm/damon/sysfs-schemes component, specifically in how DAMOS tried region directory objects are managed via a linked list. When the DAMON sysfs removal function damon_sysfs_scheme_regions_rm_dirs() releases kobj objects, the container region object is only removed from the linked list inside the kobj release callback. Delayed callback invocation can leave freed regions on the list, leading to list corruption and use-after-free conditions when new region directories are created.

Critical Impact
Local users can trigger a kernel use-after-free by repeatedly requesting DAMON scheme region updates via sysfs, potentially causing memory corruption or kernel crashes.

Affected Products

Linux kernel builds with CONFIG_DEBUG_KOBJECT_RELEASE enabled
Linux kernel versions containing the DAMON sysfs schemes implementation
Systems exposing /sys/kernel/mm/damon/admin/ interfaces to privileged users

Discovery Timeline

2026-07-24 - CVE-2026-64239 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64239

Vulnerability Analysis

The vulnerability resides in the DAMON sysfs schemes subsystem, which maintains DAMOS (DAMON-based Operation Schemes) tried region directory objects in a linked list. When a user requests directory refresh through the sysfs state file, DAMON removes all existing region directories and creates updated ones in the same location.

The removal function damon_sysfs_scheme_regions_rm_dirs() invokes kobject_put() on each region object, but the actual list removal is deferred to the kobj release callback. If callback execution is delayed, the linked list retains entries pointing to memory scheduled for deallocation. Subsequent directory creation walks this stale list, resulting in list corruption and use-after-free access.

Root Cause

The root cause is an ordering issue between reference count decrement and linked list removal. The container region object was removed from the list inside the kobject release callback rather than at the point of reference count decrement. This design assumes synchronous release semantics, which does not hold under CONFIG_DEBUG_KOBJECT_RELEASE where releases are intentionally delayed. Additionally, damos_sysfs_populate_region_dir() added region objects to the list before kobject_init_and_add() succeeded, allowing failed initializations to leave deallocated objects on the list.

Attack Vector

Exploitation requires local access with sufficient privileges to write to /sys/kernel/mm/damon/admin/kdamonds/*/state. The reproducer demonstrates the issue by repeatedly writing update_schemes_tried_regions to the state file:

# damo start --damos_action stat
# cd /sys/kernel/mm/damon/admin/kdamonds/0/
# for i in {1..10}; do echo update_schemes_tried_regions > state; done
# dmesg | grep underflow
[   89.296152] refcount_t: underflow; use-after-free.

The resulting refcount_t underflow indicates memory reuse after free, which under certain conditions can lead to kernel memory corruption.

Detection Methods for CVE-2026-64239

Indicators of Compromise

Kernel log messages containing refcount_t: underflow; use-after-free originating from DAMON sysfs operations
Repeated writes to /sys/kernel/mm/damon/admin/kdamonds/*/state with the value update_schemes_tried_regions
Kernel panics or oops messages referencing damon_sysfs_scheme_regions_rm_dirs or damos_sysfs_populate_region_dir

Detection Strategies

Monitor kernel ring buffer output via dmesg for refcount underflow warnings and list corruption traces
Audit sysfs write operations targeting the DAMON admin interface using auditd rules on /sys/kernel/mm/damon/
Correlate unusual DAMON scheme state transitions with process activity from unprivileged or containerized workloads

Monitoring Recommendations

Enable kernel lockdep and KASAN on test systems to catch use-after-free conditions before production exposure
Track access to DAMON sysfs paths using Linux Audit framework and forward events to a centralized logging platform
Alert on kernel warnings referencing mm/damon/sysfs-schemes.c file paths in kernel stack traces

How to Mitigate CVE-2026-64239

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable tree commits
Restrict write access to /sys/kernel/mm/damon/admin/ to trusted administrative users only
Disable CONFIG_DEBUG_KOBJECT_RELEASE on production kernels unless required for debugging

Patch Information

The fix removes the region object from the linked list at reference count decrement time rather than in the release callback. It also updates damos_sysfs_populate_region_dir() to add region objects to the list only after kobject_init_and_add() succeeds. Patches are available in the following kernel.org stable commits: Kernel.org Commit 0ba6c05, Kernel.org Commit 2c33177, Kernel.org Commit 441f92f, Kernel.org Commit a5fa422, and Kernel.org Commit c0e3701.

Workarounds

Unmount or restrict permissions on the DAMON sysfs interface where DAMON functionality is not required
Ensure CONFIG_DEBUG_KOBJECT_RELEASE is disabled in production kernel builds, as the issue is reliably reproducible only with this option enabled
Limit local user access to systems running DAMON-enabled kernels until patches are deployed

bash

# Restrict access to DAMON sysfs interface
chmod 700 /sys/kernel/mm/damon/admin/
# Verify CONFIG_DEBUG_KOBJECT_RELEASE is disabled
grep CONFIG_DEBUG_KOBJECT_RELEASE /boot/config-$(uname -r)