CVE-2026-72178: mm/damon/core: always put unsuccessfully committed target pids
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: always put unsuccessfully committed target pids
damoncommittarget() puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid. It gets the source pid because the caller is supposed to eventually put the pids. In more detail, the caller will call damondestroyctx() after damoncommitctx() to destroy the entire source context. And in this case, [f]vaddr operation set's cleanuptarget() callback will put the pids.
The commit operation is made at the context level. The operation can fail in multiple places including in the middle and after the targets commit operations. For any such failures, immediately the error is returned to the damoncommitctx() caller. If some or all of the source target pids were committed to the destination during the unsuccessful context commit attempt, those pids should be put twice.
The source context will do the put operations using the above explained routine. However, let's suppose the destination context was not originally using [f]vaddr operation set and the commit failed before the ops of the source context is committed. The destination does not have the cleanuptarget() ops callback, so it cannot put the pids via the damondestroyctx().
As a result, the pids are leaked. The issue in the real world would be not very common. The commit feature is for changing parameters of running DAMON context while inheriting internal status like the monitoring results. The monitoring results of a physical address range ain't have things that are beneficial to be inherited to a virtual address ranges monitoring. So the problem-causing DAMON control would be not very common in the real world. That said, it is a supported feature. And damoncommittarget() failure due to memory allocation is relatively realistic [1] if there are a huge number of target regions.
Fix by putting the pids in the commit operation in case of the failures.
The issue was discovered [2] by Sashiko.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the fix in mm/damon/core to ensure that if damon_commit_target() fails (e.g., due to memory allocation failure during context/target commit), the target PIDs that were unsuccessfully committed are still put/released (so they are not leaked).
Linux kernel mm/damon/core put unsuccessfully committed target pids (on damon_commit_target/ctx failure paths) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72178?
CVE-2026-72178 has a risk score of 15, indicating a high severity vulnerability.
How do I fix CVE-2026-72178?
To remediate CVE-2026-72178, update your Linux kernel to the latest patched version as recommended by the maintainers.
What systems are affected by CVE-2026-72178?
CVE-2026-72178 affects the Linux kernel versions that include the mm/damon/core functionality.
What is the impact of CVE-2026-72178?
The vulnerability can potentially lead to resource management issues within the kernel, impacting system stability.
Is CVE-2026-72178 being actively exploited?
As of now, there have been no confirmed active exploits targeting CVE-2026-72178.