CVE-2026-23144

What it actually does

Incomplete cleanup of attrs/ subdirectories on DAMON sysfs context directory setup failure leaves dangling directories and leaks kernel memory, rendering the DAMON sysfs interface unusable until reboot.

Why it matters to the business

Systems using the DAMON sysfs interface can experience persistent monitoring breakage and gradual memory exhaustion after certain setup errors, potentially requiring unplanned reboots on affected Linux kernels.

How an attack unfolds

An attacker with local access triggers a partial failure during DAMON context directory creation via sysfs after the attrs/ subdirectory is created; the missing cleanup leaves the interface in a broken state and leaks memory, achieving local denial of service without needing further privileges or network access.

How to fix it

Upgrade to a kernel containing commit db7dfe78fc81bdd2b532d77f340fe453f2360426 or later; apply the stable kernel update that includes the attrs/ subdirectory cleanup on setup failure.

How to confirm the fix worked

Confirm the running kernel includes commit db7dfe78fc81bdd2b532d77f340fe453f2360426; attempt DAMON sysfs context creation under controlled failure conditions and verify that attrs/ subdirectories are properly removed and no memory leak occurs.

Typical attack path

1. Obtain local user access on a Linux system running an affected kernel
2. Interact with the DAMON sysfs interface to initiate context directory setup
3. Force a failure condition after attrs/ subdirectories are created
4. Observe that subdirectories remain and the interface is unusable, with memory leaked

How to detect it

Review kernel logs for DAMON sysfs setup failure messages around the time of interface breakage; inspect for repeated memory pressure or leaks attributable to unreleased sysfs directories; no widespread exploitation artifacts are expected given the local-only nature and low EPSS.

What your security team should do

• Prioritize patching production kernels that expose DAMON via sysfs
• Monitor for kernel updates containing the referenced commit and schedule rollout within normal change windows given low EPSS and no KEV listing
• Limit unprivileged local access to sysfs DAMON controls where feasible until patched