CVE-2026-64239 - Vulnerability Details

- mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()

DAMON sysfs maintains the DAMOS tried region directory objects via a
linked list. When the user requests refresh of the directories, DAMON
sysfs removes all the region directories first, and then generate updated
regions directory on the empty space. The removal function
(damon_sysfs_scheme_regions_rm_dirs()) only puts the kobj objects.
Deletion of the container region object from the linked list is done
inside the kobj release callback function.

If somehow the callback invocation is delayed, the list will contain
regions list that gonna be freed. If the updated region directories
creation is started in this situation, the list can be corrupted and
use-after-free can happen.

Because the kobj objects are managed by only DAMON sysfs, the issue cannot
happen in normal situation. But, such delays can be made on kernels that
built with CONFIG_DEBUG_KOBJECT_RELEASE. On the kernel, the issue can
indeed be reproduced like below.

# damo start --damos_action stat
# cd /sys/kernel/mm/damon/admin/kdamonds/0/
# for i in {1..10}; do echo update_schemes_tried_regions > state; done
# dmesg | grep underflow
[ 89.296152] refcount_t: underflow; use-after-free.

Fix the issue by removing the region object from the list when
decrementing the reference count.

Also update damos_sysfs_populate_region_dir() to add the region object to
the list only after the kobject_init_and_add() is success, so that fail of
kobject_init_and_add() is not leaving the deallocated object on the list.

The issue was discovered [1] by Sashiko.

Published: 2026-07-24

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s DAMON subsystem can corrupt its internal linked list when the sysfs interface is asked to refresh region directories. The removal routine removes kobject entries but relies on a delayed kobject release callback to unlink them. If that callback is delayed, the list still contains entries scheduled for freeing while new directories are being created, corrupting the list and causing a use‑after‑free. An attacker with access to the DAMON sysfs node "update_schemes_tried_regions" can trigger the flaw. The bug is limited to kernels built with CONFIG_DEBUG_KOBJECT_RELEASE, so standard kernels without this configuration are unaffected.

Affected Systems

Linux kernels that include the DAMON subsystem and are compiled with CONFIG_DEBUG_KOBJECT_RELEASE, exposing /sys/kernel/mm/damon and allowing region directory refreshes via DAMON sysfs, are affected. No specific kernel release numbers are listed, so any such kernel remains at risk.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score is below 1 %, and the vulnerability is not listed in CISA KEV, suggesting a low likelihood of exploitation in the wild. However, the flaw can be triggered by any local user who can write to the DAMON sysfs node "update_schemes_tried_regions". If the delayed kobject release callback occurs after the list has been cleared, the linked list can become corrupted, and the subsequent use of the freed region objects can lead to a use‑after‑free that may allow kernel memory corruption, local privilege escalation or denial of service. The vulnerability requires the kernel to be built with CONFIG_DEBUG_KOBJECT_RELEASE and the DAMON sysfs interface to be exposed; standard production kernels without this configuration are not affected.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9277d0367ba18ef4bb98bafb1209e715844cdf7e`	affected	< c0e37017a452addec873865c94cf7a665663a9b2
`9277d0367ba18ef4bb98bafb1209e715844cdf7e`	affected	< a5fa42214de55e43d165144727ce9facb9fc6b08
`9277d0367ba18ef4bb98bafb1209e715844cdf7e`	affected	< 0ba6c05156d9ff9fc6ca22b7690e2eec9eca66f7
`9277d0367ba18ef4bb98bafb1209e715844cdf7e`	affected	< 2c33177023c92e76806c535ddbffaa3d3fc37777
`9277d0367ba18ef4bb98bafb1209e715844cdf7e`	affected	< 441f92f7d386b85bad16de49db95a307cba048a2

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9277d0367ba18ef4bb98bafb1209e715844cdf7e,0ba6c05156d9ff9fc6ca22b7690e2eec9eca66f7)`	affected	code_commit	—
`[9277d0367ba18ef4bb98bafb1209e715844cdf7e,2c33177023c92e76806c535ddbffaa3d3fc37777)`	affected	code_commit	—
`[9277d0367ba18ef4bb98bafb1209e715844cdf7e,441f92f7d386b85bad16de49db95a307cba048a2)`	affected	code_commit	—
`[9277d0367ba18ef4bb98bafb1209e715844cdf7e,a5fa42214de55e43d165144727ce9facb9fc6b08)`	affected	code_commit	—
`[9277d0367ba18ef4bb98bafb1209e715844cdf7e,c0e37017a452addec873865c94cf7a665663a9b2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	semver	—
`[0,6.2)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the DAMON sysfs fix (see kernel commit references).
If an upgrade is not feasible, disable CONFIG_DEBUG_KOBJECT_RELEASE during kernel build or remove the DAMON sysfs interface from the system.
Continuously monitor system logs for "refcount_t: underflow" messages and audit writes to /sys/kernel/mm/damon/admin/*.

Generated by OpenCVE AI on August 13, 2026 at 19:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00156.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0ba6c05156d9ff9fc6ca22b7690e2eec9eca66f7
https://git.kernel.org/stable/c/2c33177023c92e76806c535ddbffaa3d3fc37777
https://git.kernel.org/stable/c/441f92f7d386b85bad16de49db95a307cba048a2
https://git.kernel.org/stable/c/a5fa42214de55e43d165144727ce9facb9fc6b08
https://git.kernel.org/stable/c/c0e37017a452addec873865c94cf7a665663a9b2
https://lore.kernel.org/linux-cve-announce/2026072441-CVE-2026-64239-25b9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64239
https://www.cve.org/CVERecord?id=CVE-2026-64239

History

Thu, 13 Aug 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 05 Aug 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 29 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072441-CVE-2026-64239-25b9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64239 https://www.cve.org/CVERecord?id=CVE-2026-64239
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 28 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() DAMON sysfs maintains the DAMOS tried region directory objects via a linked list. When the user requests refresh of the directories, DAMON sysfs removes all the region directories first, and then generate updated regions directory on the empty space. The removal function (damon_sysfs_scheme_regions_rm_dirs()) only puts the kobj objects. Deletion of the container region object from the linked list is done inside the kobj release callback function. If somehow the callback invocation is delayed, the list will contain regions list that gonna be freed. If the updated region directories creation is started in this situation, the list can be corrupted and use-after-free can happen. Because the kobj objects are managed by only DAMON sysfs, the issue cannot happen in normal situation. But, such delays can be made on kernels that built with CONFIG_DEBUG_KOBJECT_RELEASE. On the kernel, the issue can indeed be reproduced like below. # damo start --damos_action stat # cd /sys/kernel/mm/damon/admin/kdamonds/0/ # for i in {1..10}; do echo update_schemes_tried_regions > state; done # dmesg \| grep underflow [ 89.296152] refcount_t: underflow; use-after-free. Fix the issue by removing the region object from the list when decrementing the reference count. Also update damos_sysfs_populate_region_dir() to add the region object to the list only after the kobject_init_and_add() is success, so that fail of kobject_init_and_add() is not leaving the deallocated object on the list. The issue was discovered [1] by Sashiko.
Title		mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ba6c05156d9ff9fc6ca22b7690e2eec9eca66f7 https://git.kernel.org/stable/c/2c33177023c92e76806c535ddbffaa3d3fc37777 https://git.kernel.org/stable/c/441f92f7d386b85bad16de49db95a307cba048a2 https://git.kernel.org/stable/c/a5fa42214de55e43d165144727ce9facb9fc6b08 https://git.kernel.org/stable/c/c0e37017a452addec873865c94cf7a665663a9b2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-24T15:27:43.057Z

Updated: 2026-07-24T15:27:43.057Z

Reserved: 2026-07-19T15:36:31.772Z

Link: CVE-2026-64239

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-24T16:16:53.193

Modified: 2026-08-13T17:25:56.233

Link: CVE-2026-64239

Redhat

Severity : Moderate

Publid Date: 2026-07-24T00:00:00Z

Links: CVE-2026-64239 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T19:15:03Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object