CVE-2026-64239: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: delete tried region in regionsrmdirs()
DAMON sysfs maintains the DAMOS tried region directory objects via a linked list. When the user requests refresh of the directories, DAMON sysfs removes all the region directories first, and then generate updated regions directory on the empty space. The removal function (damonsysfsschemeregionsrmdirs()) only puts the kobj objects. Deletion of the container region object from the linked list is done inside the kobj release callback function.
If somehow the callback invocation is delayed, the list will contain regions list that gonna be freed. If the updated region directories creation is started in this situation, the list can be corrupted and use-after-free can happen.
Because the kobj objects are managed by only DAMON sysfs, the issue cannot happen in normal situation. But, such delays can be made on kernels that built with CONFIGDEBUGKOBJECTRELEASE. On the kernel, the issue can indeed be reproduced like below.
# damo start --damosaction stat # cd /sys/kernel/mm/damon/admin/kdamonds/0/ # for i in {1..10}; do echo updateschemestriedregions > state; done # dmesg | grep underflow [ 89.296152] refcountt: underflow; use-after-free.
Fix the issue by removing the region object from the list when decrementing the reference count.
Also update damossysfspopulateregiondir() to add the region object to the list only after the kobjectinitandadd() is success, so that fail of kobjectinitandadd() is not leaving the deallocated object on the list.
The issue was discovered [1] by Sashiko.
Affected Software
Event History
Frequently Asked Questions
Are production kernels affected under normal conditions?
The issue cannot occur in normal conditions because the relevant kobject objects are managed only by DAMON sysfs. It can be reproduced when the kernel is built with CONFIG_DEBUG_KOBJECT_RELEASE, which can delay kobject release callbacks.
What access is needed to trigger the issue?
An attacker needs local access with permission to operate DAMON sysfs and request updates of DAMOS tried-region directories. The described trigger repeatedly requests update_schemes_tried_regions while delayed kobject releases leave stale entries in the linked list.
How can I identify systems with the described exposure condition?
Check whether the running kernel was built with CONFIG_DEBUG_KOBJECT_RELEASE and whether DAMON sysfs is in use for DAMOS schemes that expose tried-region directories. Systems without the delayed kobject-release condition are not described as reproducible by the provided information.