CVE-2021-47088

What it actually does

Race condition between dbgfs_target_ids_read holding kdamond_lock and dbgfs_before_terminate destroying targets without the lock, resulting in use-after-free on Linux kernel DAMON debugfs structures.

Why it matters to the business

Local attackers with debugfs access can trigger kernel memory corruption, leading to system crashes, denial of service, or potential privilege escalation on affected Linux systems.

How an attack unfolds

An attacker with local access opens DAMON debugfs interfaces, starts a kdamond thread, then concurrently reads target IDs while triggering termination; the unprotected destruction allows reuse of freed target objects and memory corruption.

How to fix it

Upgrade the Linux kernel to a version containing the fix that acquires kdamond_lock during target destruction in dbgfs_before_terminate; apply the patch from the mainline commit if backporting is required.

How to confirm the fix worked

Verify the running kernel contains the commit protecting dbgfs_before_terminate with kdamond_lock; inspect debugfs code paths for the added lock acquisition and test concurrent read/terminate operations under lock.

Typical attack path

1. Obtain local shell or code execution on target Linux system
2. Access DAMON debugfs files under /sys/kernel/debug/damon/
3. Initialize monitoring targets and start kdamond
4. Trigger concurrent dbgfs_target_ids_read and dbgfs_before_terminate operations
5. Exploit resulting use-after-free for memory corruption or control-flow hijack

How to detect it

Review kernel logs for use-after-free warnings or oops involving damon dbgfs functions; correlate with processes accessing /sys/kernel/debug/damon/ immediately before crashes; inspect audit logs for unusual debugfs activity.

What your security team should do

• Prioritize kernel updates on systems exposing DAMON debugfs to untrusted local users
• Restrict debugfs access via mount options or permissions where DAMON is not required
• Monitor for kernel oops or panic logs referencing damon or dbgfs_target_ids
• Audit custom kernels or embedded devices for the missing lock around target destruction