SB20260816343 - Missing Release of Resource after Effective Lifetime in Linux kernel damon

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72178)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in damon_commit_target() and DAMON context commit handling in mm/damon/core when committing target pids between DAMON contexts and the commit operation fails. A local user can trigger a failed DAMON context commit to cause a denial of service.

The issue occurs in a supported but uncommon case where target pids are committed from a source context to a destination context that does not use the [f]vaddr operation set, and failure can occur during the commit operation, including due to memory allocation with a huge number of target regions.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3b91c35961fa5553b4dd36db1f06e3b4acbfc05d
• https://git.kernel.org/stable/c/6a66c557a2ab2609575bafd15e093669c05f9711
• https://git.kernel.org/stable/c/837f619f1d98e967bd63e51ecd1e77bfa468992d
• https://git.kernel.org/stable/c/ea07e045611ca00f1ec7e448fd43e655d311158b