Use-after-free in Linux kernel - CVE-2026-46183
Published: May 29, 2026
Vulnerability identifier: #VU133019
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-46183
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to use-after-free in damon_sysfs_quot_goal->path handling in the DAMON sysfs 'path' file when performing concurrent reads and writes through separate open files. A local user can trigger concurrent access to read freed memory and disclose sensitive information.
The issue does not race when the same open file is used for both operations due to kernfs open file locking.
How to mitigate CVE-2026-46183
Install security update from vendor's repository.