CVE-2026-90005 - Vulnerability Details

- samples/damon/wsse: handle damon_start() failure

Description

In the Linux kernel, the following vulnerability has been resolved:

samples/damon/wsse: handle damon_start() failure

Patch series "samples/damon: handle damon_{start,stop}() failures".

All DAMON sample modules are not correctly handling failures from
damon_start(). Among those, mtier also has an additional problem for
handling of damon_stop() failures. wsse and prcl also have a problem in
their damon_call() failure handling. As a result, memory leaks, next
DAMON operation disruptions, and use-after-free can happen. Fix those.

Note that only the damon_start() failure caused issues can reliably be
reproduced. Reproducing those issues require the admin permission,
though.

This patch (of 6):

damon_sample_wsse_start() callers assume it will clean up resources when
it fails. And the function does the cleanup for context buildup failures.
However, it is not doing the cleanup for damon_start() failure. As a
result, when damon_start() fails, it leaks the memory for DAMON context.
Free the context in case of the failure to fix the issues.

Note that the issue can reliably be reproduced because the module calls
damon_start() in the exclusive mode. For example,

$ sudo damo start
$ echo $$ | sudo tee /sys/module/damon_sample_wsse/parameters/target_pid
$ echo Y | sudo tee /sys/module/damon_sample_wsse/parameters/enabled
$ sudo cat /proc/allocinfo | grep damon_new_ctx

Because the first command is running another DAMON instance, the third
command fails the damon_start() call because the new DAMON instance cannot
exclusively run. And without this fix, by repeating the third and the
fourth commands above, we can show the memory consumption is only
increasing due to the leaks. It requires the sudo permission though.

The issue was discovered [1] by Sashiko.

Published: 2026-09-16

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s DAMON sample modules fail to release allocated resources when damon_start() returns an error. This oversight causes memory leaks, disrupts subsequent DAMON operations, and may lead to use‑after‑free conditions if the stale context is later accessed. The flaw is triggered by the kernel’s caller logic, which incorrectly assumes that cleanup will be handled automatically and does not account for start‑failure cleanup paths.

Affected Systems

All Linux kernel distributions that include the DAMON sample modules (specifically wsse, mtier, and prcl). Reproduction requires privileged (sudo) access to start and configure these modules, but the impact is confined to systems where the affected sample modules are loaded.

Risk and Exploitability

The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. An attacker would need local administrative privileges to trigger damon_start() failures. While the vulnerability can cause resource exhaustion and kernel instability, the limited attack surface and the need for elevation reduce the overall risk compared to remote‑exploitable flaws.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b757c6cfc696d43501632861f731412b14a7be86`	affected	< 6179c7f47876d576dfe30efa8fbf1b0b1fdd13c0
`b757c6cfc696d43501632861f731412b14a7be86`	affected	< e60774d6335b89fac0be8b17a041fcffc508d281
`b757c6cfc696d43501632861f731412b14a7be86`	affected	< e4742be45ea45bf554399ce89a09f71e525d7981

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b757c6cfc696d43501632861f731412b14a7be86,6179c7f47876d576dfe30efa8fbf1b0b1fdd13c0)`	affected	code_commit	—
`[b757c6cfc696d43501632861f731412b14a7be86,e60774d6335b89fac0be8b17a041fcffc508d281)`	affected	code_commit	—
`[b757c6cfc696d43501632861f731412b14a7be86,e4742be45ea45bf554399ce89a09f71e525d7981)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.14`	affected	generic	—
`[0,6.14)`	unaffected	generic	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official kernel patch that frees DAMON context on damon_start() failure
Stop any running DAMON instance before starting a new one to prevent exclusive mode conflicts
If the patch cannot be applied immediately, disable the DAMON sample modules or restrict access to trusted administrators
Monitor kernel memory usage via /proc/allocinfo or similar tools to detect ongoing leaks

Generated by OpenCVE AI on September 18, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00206.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/6179c7f47876d576dfe30efa8fbf1b0b1fdd13c0
https://git.kernel.org/stable/c/e4742be45ea45bf554399ce89a09f71e525d7981
https://git.kernel.org/stable/c/e60774d6335b89fac0be8b17a041fcffc508d281

History

Fri, 18 Sep 2026 00:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401 CWE-416

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: samples/damon/wsse: handle damon_start() failure Patch series "samples/damon: handle damon_{start,stop}() failures". All DAMON sample modules are not correctly handling failures from damon_start(). Among those, mtier also has an additional problem for handling of damon_stop() failures. wsse and prcl also have a problem in their damon_call() failure handling. As a result, memory leaks, next DAMON operation disruptions, and use-after-free can happen. Fix those. Note that only the damon_start() failure caused issues can reliably be reproduced. Reproducing those issues require the admin permission, though. This patch (of 6): damon_sample_wsse_start() callers assume it will clean up resources when it fails. And the function does the cleanup for context buildup failures. However, it is not doing the cleanup for damon_start() failure. As a result, when damon_start() fails, it leaks the memory for DAMON context. Free the context in case of the failure to fix the issues. Note that the issue can reliably be reproduced because the module calls damon_start() in the exclusive mode. For example, $ sudo damo start $ echo $$ \| sudo tee /sys/module/damon_sample_wsse/parameters/target_pid $ echo Y \| sudo tee /sys/module/damon_sample_wsse/parameters/enabled $ sudo cat /proc/allocinfo \| grep damon_new_ctx Because the first command is running another DAMON instance, the third command fails the damon_start() call because the new DAMON instance cannot exclusively run. And without this fix, by repeating the third and the fourth commands above, we can show the memory consumption is only increasing due to the leaks. It requires the sudo permission though. The issue was discovered [1] by Sashiko.
Title		samples/damon/wsse: handle damon_start() failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6179c7f47876d576dfe30efa8fbf1b0b1fdd13c0 https://git.kernel.org/stable/c/e4742be45ea45bf554399ce89a09f71e525d7981 https://git.kernel.org/stable/c/e60774d6335b89fac0be8b17a041fcffc508d281

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:33:14.753Z

Updated: 2026-09-16T10:33:14.753Z

Reserved: 2026-09-11T19:38:34.780Z

Link: CVE-2026-90005

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:17:13.100

Modified: 2026-09-16T11:17:13.100

Link: CVE-2026-90005

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-18T00:30:16Z

Weaknesses

CWE-401
Missing Release of Memory after Effective Lifetime
CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object