LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46183: mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock damon_sysfs_quot_goal->path can be read and written by users, via DAMON sysfs 'path' file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters committing are protected by damon_sysfs_lock to avoid the sysfs files being destroyed while any of the parameters are being read. But the user-driven direct reads and writes are not protected by any lock, while the write is deallocating the path-pointing buffer. As a result, the readers could read the already freed buffer (user-after-free). Note that the user-reads don't race when the same open file is used by the writer, due to kernfs's open file locking. Nonetheless, doing the reads and writes with separate open files would be common. Fix it by protecting both the user-direct reads and writes with damon_sysfs_lock.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a race in DAMON sysfs handling. When one user-facing sysfs operation frees a stored path while another reads it, the kernel can access freed memory. The public data does not provide CVSS, impact details, or exploitation evidence, so business urgency should be driven by whether exposed systems use affected kernels and DAMON sysfs.

Executive priority

Treat this as a targeted kernel maintenance item until severity is clarified. Prioritize internet-facing or multi-tenant Linux infrastructure only if DAMON sysfs is enabled or local users can reach the relevant interface. There is no sourced evidence of active exploitation.

Technical view

DAMON sysfs scheme quota goal path reads and writes were not both covered by damon_sysfs_lock. A write could kfree() the path buffer while a separate open file reads it, creating a use-after-free. The kernel fix protects direct user reads and writes with damon_sysfs_lock, matching the locking already used during parameter commits.

Likely exposure

Likely exposure is Linux systems running affected kernel builds where DAMON sysfs schemes are available or used. The affected metadata names Linux versions including 6.19, 7.0.7, and 7.1, but distribution backports and exact package status require vendor verification.

Exploitation context

No cited source states active exploitation, and the CVE is not marked in KEV. The description indicates the race is reachable through DAMON sysfs path file reads and writes using separate open files. The sources do not define required privileges, practical exploitability, or security impact beyond use-after-free.

Researcher notes

The key bug is missing damon_sysfs_lock coverage around direct sysfs path reads and writes while write-side deallocation occurs. The source does not provide exploit primitives, privilege requirements, or crash-versus-code-execution impact. Validate against fixed stable commits rather than assuming upstream version numbers map directly to distro kernels.

Mitigation direction

  • Check kernel vendor advisories for CVE-2026-46183 package status.
  • Update to a kernel containing the referenced stable fixes.
  • Prioritize systems where DAMON sysfs is enabled or operationally used.
  • If patching is delayed, review vendor guidance for DAMON sysfs exposure reduction.

Validation and detection

  • Inventory running kernel versions across Linux hosts.
  • Confirm whether vendor kernel packages include the stable fix commits.
  • Check whether DAMON sysfs interfaces are present or enabled on critical systems.
  • Track CVE updates for CVSS, affected-version clarifications, and distro backports.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46183 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc41e253a411eb73a5ac651c14f40c2ea2f274ebd, c41e253a411eb73a5ac651c14f40c2ea2f274ebdunaffected
LinuxLinux6.19, 0, 7.0.7, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.