CVE-2026-46183: mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock
damon_sysfs_quot_goal->path can be read and written by users, via DAMON
sysfs 'path' file. It can also be indirectly read, for the parameters
{on,off}line committing to DAMON. The reads for parameters committing are
protected by damon_sysfs_lock to avoid the sysfs files being destroyed
while any of the parameters are being read. But the user-driven direct
reads and writes are not protected by any lock, while the write is
deallocating the path-pointing buffer. As a result, the readers could
read the already freed buffer (user-after-free). Note that the user-reads
don't race when the same open file is used by the writer, due to kernfs's
open file locking. Nonetheless, doing the reads and writes with separate
open files would be common. Fix it by protecting both the user-direct
reads and writes with damon_sysfs_lock.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue is a race in DAMON sysfs handling. When one user-facing sysfs operation frees a stored path while another reads it, the kernel can access freed memory. The public data does not provide CVSS, impact details, or exploitation evidence, so business urgency should be driven by whether exposed systems use affected kernels and DAMON sysfs.
Executive priority
Treat this as a targeted kernel maintenance item until severity is clarified. Prioritize internet-facing or multi-tenant Linux infrastructure only if DAMON sysfs is enabled or local users can reach the relevant interface. There is no sourced evidence of active exploitation.
Technical view
DAMON sysfs scheme quota goal path reads and writes were not both covered by damon_sysfs_lock. A write could kfree() the path buffer while a separate open file reads it, creating a use-after-free. The kernel fix protects direct user reads and writes with damon_sysfs_lock, matching the locking already used during parameter commits.
Likely exposure
Likely exposure is Linux systems running affected kernel builds where DAMON sysfs schemes are available or used. The affected metadata names Linux versions including 6.19, 7.0.7, and 7.1, but distribution backports and exact package status require vendor verification.
Exploitation context
No cited source states active exploitation, and the CVE is not marked in KEV. The description indicates the race is reachable through DAMON sysfs path file reads and writes using separate open files. The sources do not define required privileges, practical exploitability, or security impact beyond use-after-free.
Researcher notes
The key bug is missing damon_sysfs_lock coverage around direct sysfs path reads and writes while write-side deallocation occurs. The source does not provide exploit primitives, privilege requirements, or crash-versus-code-execution impact. Validate against fixed stable commits rather than assuming upstream version numbers map directly to distro kernels.
Mitigation direction
Check kernel vendor advisories for CVE-2026-46183 package status.
Update to a kernel containing the referenced stable fixes.
Prioritize systems where DAMON sysfs is enabled or operationally used.
If patching is delayed, review vendor guidance for DAMON sysfs exposure reduction.
Validation and detection
Inventory running kernel versions across Linux hosts.
Confirm whether vendor kernel packages include the stable fix commits.
Check whether DAMON sysfs interfaces are present or enabled on critical systems.
Track CVE updates for CVSS, affected-version clarifications, and distro backports.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-46183 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
3Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
May 28, 2026, 09:36 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.