CVE-2026-90005 Overview
CVE-2026-90005 is a Linux kernel vulnerability in the samples/damon/wsse module. The flaw exists in damon_sample_wsse_start(), which fails to release a DAMON context when damon_start() returns an error. The result is a kernel memory leak that grows with each failed enable attempt. The broader patch series also addresses related issues in the mtier and prcl sample modules, including a potential use-after-free from mishandled damon_call() failures.
Triggering the leak requires administrator privileges on the affected host, because writing to the module parameters under /sys/module/damon_sample_wsse/parameters/ requires root access.
Critical Impact
Repeated failed activations of the damon_sample_wsse module leak kernel memory allocated by damon_new_ctx(), and sibling fixes in the series prevent use-after-free and DAMON operation disruption in mtier and prcl.
Affected Products
- Linux kernel samples/damon/wsse sample module
- Linux kernel samples/damon/mtier sample module (related fix in series)
- Linux kernel samples/damon/prcl sample module (related fix in series)
Discovery Timeline
- 2026-09-16 - CVE-2026-90005 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90005
Vulnerability Analysis
DAMON (Data Access MONitor) is a Linux kernel subsystem for monitoring memory access patterns. The samples/damon/wsse module demonstrates working-set size estimation on top of DAMON. Callers of damon_sample_wsse_start() assume the function cleans up allocated resources on failure. The function does release the DAMON context when context buildup fails, but not when the subsequent call to damon_start() fails.
Because the sample module invokes damon_start() in exclusive mode, the call reliably fails whenever another DAMON instance is already running. Each failed enable therefore leaks the context returned by damon_new_ctx(). The related fixes in the patch series address damon_stop() failure handling in mtier and damon_call() failure handling in wsse and prcl, where mishandling can lead to next-operation disruption or use-after-free.
Root Cause
The root cause is missing cleanup on an error path [CWE-401: Memory Leak]. When damon_start() returns an error inside damon_sample_wsse_start(), control exits the function without freeing the DAMON context previously allocated with damon_new_ctx(). The context memory becomes unreachable and remains allocated for the lifetime of the kernel.
Attack Vector
Exploitation requires local root privileges. A privileged user writes to /sys/module/damon_sample_wsse/parameters/enabled while another DAMON instance is active, forcing damon_start() to fail in exclusive mode. Repeating the enable operation grows kernel memory consumption without bound. The upstream reporter confirmed the leak by observing entries in /proc/allocinfo for damon_new_ctx after repeated failed activations. The related damon_call() handling defects can, under specific timing, escalate into a use-after-free condition.
See the upstream commits 6179c7f, e4742be, and e60774d for the code changes.
Detection Methods for CVE-2026-90005
Indicators of Compromise
- Growing allocation counts for damon_new_ctx in /proc/allocinfo on kernels with memory allocation profiling enabled.
- Repeated writes of Y to /sys/module/damon_sample_wsse/parameters/enabled from privileged shells.
- Kernel slabinfo growth in DAMON-related caches without a corresponding active workload.
Detection Strategies
- Audit for loading of the damon_sample_wsse, damon_sample_mtier, and damon_sample_prcl modules on production systems, since sample modules are not intended for production use.
- Track write syscalls targeting files under /sys/module/damon_sample_*/parameters/ and correlate with the invoking UID and process.
- Monitor unexplained increases in kernel slab memory over time on hosts that expose DAMON sample interfaces.
Monitoring Recommendations
- Collect kernel audit events for module loads (init_module, finit_module) filtered on the DAMON sample module names.
- Alert when non-root-owned automation or unexpected users interact with DAMON sysfs parameters.
- Baseline kernel memory metrics per host and flag sustained upward drift.
How to Mitigate CVE-2026-90005
Immediate Actions Required
- Upgrade to a Linux kernel release containing commits 6179c7f4, e4742be4, and e60774d6, which apply the patch series to the DAMON sample modules.
- Do not load DAMON sample modules on production hosts; they exist for demonstration and testing.
- Restrict root and CAP_SYS_ADMIN access to reduce the population of principals able to trigger the leak.
Patch Information
The fix is applied through the upstream patch series "samples/damon: handle damon_{start,stop}() failures". Relevant commits are 6179c7f47876, e4742be45ea4, and e60774d6335b. Downstream distribution kernels should pick up the backports; consult the vendor advisory for the supported kernel branch.
Workarounds
- Unload the affected sample modules with rmmod damon_sample_wsse damon_sample_mtier damon_sample_prcl where present.
- Blocklist the sample modules via /etc/modprobe.d/ to prevent inadvertent loading.
- Remove or restrict write permissions on /sys/module/damon_sample_*/parameters/ through kernel lockdown or MAC policy where patching is deferred.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
