CVE-2026-46121

What it actually does

This is a local Linux kernel use-after-free in the DAMON sysfs schemes interface. Concurrent reads and writes of the DAMON scheme filter memcg_path sysfs file can race because the write path frees the buffer while another file descriptor can still read it without the required damon_sysfs_lock protection. A local user with sufficient permission to interact with the DAMON sysfs controls could trigger kernel memory corruption, potentially causing a denial of service through a kernel crash and, depending on kernel build, allocator state, and exploit reliability, possible escalation of privileges or disclosure/modification of kernel memory.

Why it matters to the business

Systems exposing the affected DAMON sysfs interface may be vulnerable to local privilege escalation or crashes by users or compromised low-privilege workloads. This is not known to be exploited in the wild, is not in the CISA KEV catalog, and has a low EPSS score, so internet-scale exploitation is unlikely; however, the business risk is higher on shared Linux servers, developer workstations, container hosts, HPC systems, and environments where untrusted users or workloads can obtain local access.

How an attack unfolds

An attacker first obtains local access to an affected Linux system with enough privileges to access the DAMON sysfs scheme configuration. They locate the DAMON sysfs files under the kernel memory management sysfs hierarchy and open the memcg_path file through multiple file descriptors or processes. One execution thread repeatedly writes new values to memcg_path, causing the kernel to replace and free the previously allocated buffer, while another thread or process repeatedly reads the same sysfs attribute through a separate open file. Because the vulnerable code does not consistently hold damon_sysfs_lock around direct user reads and writes, the read path can dereference memory that has already been freed. In the simplest case this produces a kernel oops, panic, or system instability. A more capable attacker may attempt to shape kernel heap allocations around the race window to turn the use-after-free into controlled memory corruption and possible kernel-level code execution.

How to fix it

Upgrade the Linux kernel to a vendor-supported release that includes the upstream fix adding damon_sysfs_lock protection around DAMON sysfs memcg_path reads and writes. Because no exact fixed versions were provided, use the distribution vendor advisory, stable kernel changelog, or package metadata to identify the first fixed kernel for each supported branch. Prioritize shared systems and hosts where untrusted users or workloads have local access. If immediate patching is not possible, reduce exposure by disabling or avoiding DAMON sysfs functionality where feasible, restricting access to /sys/kernel/mm/damon/, limiting local shell access, preventing untrusted workloads from reaching host sysfs, and ensuring containers do not receive broad host /sys mounts or elevated privileges. Kernel hardening features such as KASLR, slab freelist hardening, SMEP/SMAP, lockdown mode, and strict sysfs permissions can reduce exploitability but should not be treated as a substitute for patching.

How to confirm the fix worked

Confirm the running kernel has been updated to a version that includes the DAMON sysfs memcg_path locking fix by checking the distribution kernel package version, vendor advisory status, and reboot state. Validate that the active kernel shown by uname -r matches the patched package, not only that a patched package is installed. Review whether CONFIG_DAMON_SYSFS is enabled and whether /sys/kernel/mm/damon/ is present; absence of the DAMON sysfs interface materially reduces exposure. Confirm that untrusted users and containers cannot write to DAMON sysfs paths. Do not validate by attempting to trigger the race on production systems, as successful reproduction can crash the host. For assurance, use vendor-provided test kernels, staging hosts, or source-level verification that direct memcg_path show/store operations are protected by damon_sysfs_lock.

Typical attack path

1. Gain local authenticated access to an affected Linux host.
2. Confirm the DAMON sysfs interface is present and accessible under /sys/kernel/mm/damon/.
3. Identify a DAMON scheme filter memcg_path sysfs attribute.
4. Open the target memcg_path file through separate readers and writers, commonly using separate processes, threads, or file descriptors.
5. Repeatedly write replacement values to memcg_path while concurrently reading it to trigger the race condition.
6. Cause a kernel use-after-free condition, resulting in a crash or potentially controlled kernel memory corruption.
7. If exploitation is reliable, use the kernel memory corruption primitive to attempt privilege escalation or disable security controls.

How to detect it

Look for evidence of local attempts to read and write DAMON sysfs files, especially memcg_path, at high frequency or from unexpected users or processes. Primary log sources include auditd logs, eBPF/syscall telemetry, EDR for Linux, shell history where available, process accounting, sudo logs, and kernel logs from dmesg, journald, /var/log/kern.log, or /var/log/messages. Kernel exploitation attempts may leave oops, panic, BUG, general protection fault, page fault, slab, or KASAN reports referencing DAMON sysfs, memcg_path, or use-after-free conditions. Successful privilege escalation may leave few direct artifacts, so correlate DAMON sysfs access with unusual privilege changes, new root shells, suspicious setuid file creation, unexpected kernel crashes, or security tooling disruption. Since this vulnerability is not currently KEV-listed and has low EPSS, prioritize retrospective hunting on systems with local untrusted users, shared compute, privileged containers, or unexplained kernel instability.

• /sys/kernel/mm/damon/
• /sys/kernel/mm/damon/admin/
• memcg_path
• /sys/kernel/mm/damon/admin/kdamonds/
• /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/schemes/*/filters/*/memcg_path
• damon_sysfs
• damon_sysfs_scheme_filter
• damon_sysfs_scheme_filter_memcg_path
• BUG: KASAN: use-after-free
• use-after-free
• general protection fault
• kernel BUG
• kernel panic
• Oops:
• slab-use-after-free
• Read of size
• Write of size

What your security team should do

• Patch affected Linux kernels through the normal emergency or high-priority kernel update process, especially on multi-user hosts, container hosts, and systems running untrusted code.
• Inventory systems where CONFIG_DAMON_SYSFS is enabled or /sys/kernel/mm/damon/ is present and prioritize those for remediation.
• Verify that patched kernels are actually running after maintenance windows; schedule reboots where required.
• Restrict local access to sensitive hosts and ensure containers or sandboxed workloads do not have writable access to host /sys/kernel/mm/damon/ paths.
• Add detection for kernel oops, panic, KASAN, or BUG messages mentioning use-after-free and DAMON sysfs components.
• Enable or tune Linux audit rules to monitor writes to DAMON sysfs paths on high-risk systems.
• Treat unexpected interaction with DAMON sysfs by non-administrative processes as suspicious and investigate for local exploit activity or misconfiguration.
• Monitor vendor advisories for exact fixed kernel package versions and backport status because the fixed versions were not provided in the input.