CVE-2026-46183

What it actually does

This is a local Linux kernel use-after-free vulnerability in the DAMON sysfs schemes interface. The vulnerable code allows the DAMON quota goal path buffer to be read and rewritten through sysfs without consistently holding damon_sysfs_lock. When one local user-controlled operation frees or replaces the path buffer while another open file descriptor reads it, the kernel can dereference freed memory. Because this occurs in kernel context, successful exploitation could allow a local authenticated attacker to crash the system, disclose kernel memory, corrupt kernel memory, or potentially escalate privileges depending on kernel build, hardening features, allocator state, and exploit reliability.

Why it matters to the business

Systems that expose the affected Linux kernel DAMON sysfs interface to local users may be vulnerable to local denial of service or privilege escalation. The practical business risk is highest on shared Linux servers, developer workstations, CI/CD runners, container hosts, high-performance computing systems, and multi-user environments where untrusted or semi-trusted users can execute local code. EPSS is currently very low and this issue is not listed in CISA KEV, so there is no strong public signal of broad exploitation, but kernel memory corruption issues should still be prioritized because a successful exploit can undermine host isolation and administrative control.

How an attack unfolds

An attacker first needs local code execution or shell access with sufficient permissions to interact with the DAMON sysfs files. They then locate the DAMON sysfs quota goal path file and open it through multiple file descriptors or processes. By racing direct reads against writes to the path file, the attacker attempts to cause one kernel path to free or replace the underlying buffer while another path still reads from it. If the race is won, the kernel reads memory after it has been freed. In a simple attack this may trigger a kernel oops or panic, causing denial of service. In a more advanced attack, the attacker attempts to shape kernel heap allocations so the freed buffer is replaced with attacker-influenced data, potentially enabling memory disclosure or kernel memory corruption that could be used for local privilege escalation.

How to fix it

Upgrade to a kernel version from the relevant Linux distribution or vendor that includes the DAMON sysfs locking fix for mm/damon/sysfs-schemes. No exact fixed version was provided in the input, so remediation should be tracked through vendor advisories and distribution kernel changelogs referencing the DAMON sysfs path kfree locking fix. Where immediate patching is not possible, reduce exposure by disabling DAMON if it is not required, preventing untrusted users from accessing DAMON sysfs controls, limiting local shell access, applying least privilege to administrative groups, and using kernel hardening features such as lockdown mode, SELinux/AppArmor policy, kptr restrictions, slab freelist hardening, and panic-on-oops policies appropriate to the environment. Containers should not be granted unnecessary host sysfs access, privileged mode, or host namespace access that could expose /sys/kernel/mm/damon/.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package includes the upstream or vendor patch protecting direct DAMON sysfs path reads and writes with damon_sysfs_lock. Check the running kernel version with uname -r and compare it against the vendor advisory or package changelog. Validate that /sys/kernel/mm/damon/ is absent, disabled, or restricted to trusted administrators where DAMON is not operationally required. If using configuration management or vulnerability scanning, ensure scanners evaluate the running kernel, not only the installed package inventory, because systems may require reboot after kernel updates. For exposure validation, inspect permissions and access controls on /sys/kernel/mm/damon/admin/ and confirm untrusted local users or containers cannot read or write DAMON scheme quota goal path files.

Typical attack path

1. Obtain local authenticated access to a Linux system running an affected kernel.
2. Confirm that DAMON sysfs support is present and accessible under /sys/kernel/mm/damon/.
3. Identify the DAMON quota goal path sysfs file for a configured DAMON scheme.
4. Open the path file through separate file descriptors or processes.
5. Continuously race reads of the path file against writes that replace or free the stored path buffer.
6. Trigger a kernel use-after-free condition in the DAMON sysfs handling code.
7. Use the condition to crash the host, leak kernel memory, or attempt controlled kernel memory corruption for privilege escalation.

How to detect it

Exploitation is local and may leave limited network-visible evidence. Review auditd, EDR, process accounting, shell history, sudo logs, and kernel logs for access to DAMON sysfs files under /sys/kernel/mm/damon/, especially high-frequency or concurrent reads and writes to quota goal path files. Kernel telemetry is important: look for KASAN reports, use-after-free warnings, slab allocator corruption, general protection faults, kernel oopses, panics, or stack traces mentioning DAMON sysfs functions. In containerized environments, review whether containers were run with privileged mode, hostPID, host mount namespace, or host /sys mounted read-write, and correlate those containers with DAMON sysfs access. Because public exploitation is not currently indicated and no KEV listing exists, detection should focus on local behavioral artifacts rather than known malware signatures.

• /sys/kernel/mm/damon/
• /sys/kernel/mm/damon/admin/
• /sys/kernel/mm/damon/admin/kdamonds/
• /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/schemes/*/quotas/goals/*/path
• damon_sysfs
• damon_sysfs_lock
• damon_sysfs_quot_goal
• kdamond
• BUG: KASAN: use-after-free
• use-after-free in damon_sysfs
• general protection fault
• kernel BUG
• Oops:
• Kernel panic
• slab-out-of-bounds
• freed by task
• Read of size
• Write of size

What your security team should do

• Prioritize patching shared, multi-user, container-hosting, CI/CD, research, and developer Linux systems where local users can execute code.
• Identify systems with DAMON enabled or with /sys/kernel/mm/damon/ present, and treat them as higher priority for validation.
• Upgrade affected kernel packages to vendor-fixed versions and reboot systems so the fixed kernel is actively running.
• Restrict access to DAMON sysfs controls to trusted administrators only; remove unnecessary privileged container access to host /sys and kernel namespaces.
• Add monitoring for unusual local access to DAMON sysfs files, especially repeated reads and writes to quota goal path files.
• Review kernel logs for use-after-free, KASAN, general protection fault, BUG, Oops, or panic messages involving DAMON or damon_sysfs.
• If suspicious crashes occurred before patching, preserve kernel logs, audit logs, shell histories, and endpoint telemetry for forensic review.