CVE-2024-57886

What it actually does

In the DAMON sysfs interface, newly created damon_target objects are leaked because they are neither deallocated on failure nor linked to the context on success during damon_commit_targets() called from damon_commit_ctx().

Why it matters to the business

Systems using the DAMON sysfs interface may suffer gradual memory exhaustion over repeated target commits, leading to degraded performance or instability; low risk given stable low EPSS and absence from KEV.

How an attack unfolds

An attacker with local access invokes the sysfs interface to repeatedly commit new DAMON targets, triggering the leak path in damon_commit_targets() and accumulating unreferenced memory objects until resource pressure occurs.

How to fix it

Update the Linux kernel to a version containing commit 3647932d0b3e609c762c55e8f9fe10a09776e0a7; only DAMON sysfs users require the update while modules such as DAMON_RECLAIM remain unaffected.

How to confirm the fix worked

Confirm the running kernel includes commit 3647932d0b3e609c762c55e8f9fe10a09776e0a7 and test sysfs target commit operations under failure and success paths to verify no leaks occur.

Typical attack path

1. Obtain local access to a system exposing the DAMON sysfs interface
2. Repeatedly add new targets via damon_commit_ctx() calls
3. Accumulate leaked damon_target objects to exhaust memory

How to detect it

Inspect kernel memory statistics and DAMON-related allocations for unexpected growth after sysfs target updates; review dmesg or kernel logs for commit context errors.

What your security team should do

• Apply the referenced kernel commit on all systems exposing the DAMON sysfs interface
• Monitor memory usage trends for DAMON workloads
• Disable the sysfs interface if dedicated production modules suffice