CVE-2026-23144

mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure

Published Feb 14, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure

When a context DAMON sysfs directory setup is failed after setup of attrs/
directory, subdirectories of attrs/ directory are not cleaned up. As a
result, DAMON sysfs interface is nearly broken until the system reboots,
and the memory for the unremoved directory is leaked.

Cleanup the directories under such failures.

Analysis

AI-generated

Technical impact

A defect in the Linux kernel’s DAMON subsystem causes unremoved sysfs subdirectories to persist after a failed context directory setup, leading to a memory leak. The lingering directory structure renders the DAMON interface effectively unusable until a reboot, potentially exhausting kernel memory and impacting system stability. The vulnerability reflects a resource leak weakness.

Affected Systems

Linux kernels 6.19 release candidates 1 through 5 are affected. The issue originates in the DAMON component of the kernel; any distribution shipping these kernel versions inherits the flaw.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests low probability of exploitation in the wild. The flaw requires local kernel access, typically available to privileged users or through an exploit that gains such access. It is not listed in the CISA KEV catalog, implying no publicly known active exploits at present.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a kernel version that includes the damon sysfs cleanup patch, such as Linux kernel 6.19 rc6 or later
  • If an upgrade is not immediately possible, reboot the system to flush the corrupted sysfs entries and free the leaked memory
  • Continuously monitor the state of /sys/kernel/mm/damon to confirm the interface functions correctly after a kernel update

Generated by OpenCVE AI on October 23, 2026 at 08:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-8278-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8289-1 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8296-1 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8296-2 Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN Ubuntu USN USN-8278-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8440-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8499-1 Linux kernel (Xilinx) vulnerabilities
Ubuntu USN Ubuntu USN USN-8570-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8594-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8604-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8605-1 Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8570-2 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-8289-2 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8393-1 Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8669-1 Linux kernel (NVIDIA) vulnerabilities
History
Type Values Removed Values Added
Weaknesses CWE-401
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Type Values Removed Values Added
References
Metrics threat_severity

None

cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are not cleaned up. As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked. Cleanup the directories under such failures.
Title mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Linux
Published
Updated
Oct 19, 2026, 6:25 PM
Reserved
Jan 13, 2026, 3:37 PM
Status
Modified
Published
Feb 14, 2026, 4:15 PM
Modified
Oct 19, 2026, 7:17 PM
Severity
Important
Public date
Feb 14, 2026, 12:00 AM