CVE-2026-90006 Overview
CVE-2026-90006 is a use-after-free vulnerability in the Linux kernel's samples/damon/mtier component. The flaw resides in damon_sample_mtier_stop(), which incorrectly assumes that damon_stop() always successfully halts both DAMON (Data Access MONitor) contexts before deallocation. When one context fails to stop, typically due to memory allocation failures inside kdamond_fn(), the still-running kdamond thread continues to access memory that has already been freed.
Critical Impact
A failed damon_stop() call leaves an active DAMON kernel thread operating on freed damon_target and damon_region objects, producing a use-after-free condition in kernel space.
Affected Products
- Linux kernel with samples/damon/mtier enabled
- Kernel builds shipping the DAMON multi-tier memory sample module
- Stable branches prior to commits 215f9a7, 3c07c57, and 9dc5b6d
Discovery Timeline
- 2026-09-16 - CVE-2026-90006 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90006
Vulnerability Analysis
The DAMON subsystem allows the kernel to monitor data access patterns for memory tiering decisions. The mtier sample module creates two DAMON contexts and manages their lifecycle through damon_sample_mtier_start() and damon_sample_mtier_stop(). The stop routine issues a single damon_stop() call covering both contexts, then unconditionally frees the associated damon_target and damon_region structures.
When damon_stop() encounters a context that has already terminated, it returns an error and aborts before stopping the remaining context. The mtier cleanup path ignores this return value and proceeds to free all context memory. The surviving kdamond kernel thread then continues executing against freed structures, producing a use-after-free [CWE-416] class condition.
DAMON_SYSFS avoids this issue because it invokes damon_stop() per context individually. The defect is isolated to the mtier sample.
Root Cause
The root cause is improper error handling in damon_sample_mtier_stop(). The function batches multiple contexts into one damon_stop() call and does not verify that every context terminated before releasing their memory. Early stops triggered by allocation failures inside kdamond_fn() create the divergence between assumed and actual state.
Attack Vector
Exploitation requires local conditions that induce memory allocation failures within kdamond_fn(), causing one of the two contexts to exit early. When the sample module is subsequently stopped, the kernel frees memory still referenced by the running kdamond thread. The resulting use-after-free may lead to kernel memory corruption or denial of service. No public exploit or CISA KEV listing is associated with this CVE.
The upstream fix separates the damon_stop() invocation so each context is stopped independently, matching the behavior of DAMON_SYSFS. See the patch commits 215f9a7, 3c07c57, and 9dc5b6d for technical details.
Detection Methods for CVE-2026-90006
Indicators of Compromise
- Kernel oops or panic messages referencing kdamond_fn or damon_sample_mtier stack frames.
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free access to damon_target or damon_region objects.
- Unexpected termination of DAMON kdamond kernel threads accompanied by allocation failure warnings in dmesg.
Detection Strategies
- Enable CONFIG_KASAN on test systems to surface use-after-free access during DAMON mtier lifecycle testing.
- Audit running kernels for the samples/damon/mtier module and confirm whether patched commits are applied.
- Correlate DAMON module load and unload events with subsequent kernel warnings in centralized log storage.
Monitoring Recommendations
- Forward /var/log/kern.log and dmesg output to a centralized log platform for pattern matching on DAMON stack traces.
- Track kernel package versions across the fleet to identify hosts still running unpatched builds.
- Alert on repeated kdamond thread exits, which may indicate the allocation failure conditions that trigger the bug.
How to Mitigate CVE-2026-90006
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 215f9a7, 3c07c57, and 9dc5b6d from the stable trees.
- Rebuild and redeploy any custom kernels that ship samples/damon/mtier compiled into the image.
- If patching is not immediately possible, unload or disable the mtier DAMON sample module on affected hosts.
Patch Information
The fix separates damon_stop() into per-context invocations so each DAMON context is stopped independently before deallocation. Distribution vendors are expected to backport the patches to supported stable branches. Consult your distribution's security advisories and align kernel versions with the fixed commits.
Workarounds
- Disable the samples/damon/mtier sample by rebuilding the kernel without the sample enabled in .config.
- Restrict local access to systems running the affected sample module until patches are applied.
- Avoid enabling DAMON mtier on production nodes where kernel debugging samples are not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
