https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 10:14:02 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46121 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock</p> <p>Patch series &#34;mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path&#34;.</p> <p>Reads of &#39;memcg_path&#39; and &#39;path&#39; files in DAMON sysfs interface could race with their writes, results in use-after-free. Fix those.</p> <p>This patch (of 2):</p> <p>damon_sysfs_scheme_filter-&gt;mmecg_path can be read and written by users, via DAMON sysfs memcg_path file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters committing are protected by damon_sysfs_lock to avoid the sysfs files being destroyed while any of the parameters are being read. But the user-driven direct reads and writes are not protected by any lock, while the write is deallocating the memcg_path-pointing buffer. As a result, the readers could read the already freed buffer (user-after-free). Note that the user-reads don&#39;t race when the same open file is used by the writer, due to kernfs&#39;s open file locking. Nonetheless, doing the reads and writes with separate open files would be common. Fix it by protecting both the user-direct reads and writes with damon_sysfs_lock.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock</p> <p>Patch series &#34;mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path&#34;.</p> <p>Reads of &#39;memcg_path&#39; and &#39;path&#39; files in DAMON sysfs interface could race with their writes, results in use-after-free. Fix those.</p> <p>This patch (of 2):</p> <p>damon_sysfs_scheme_filter-&gt;mmecg_path can be read and written by users, via DAMON sysfs memcg_path file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters committing are protected by damon_sysfs_lock to avoid the sysfs files being destroyed while any of the parameters are being read. But the user-driven direct reads and writes are not protected by any lock, while the write is deallocating the memcg_path-pointing buffer. As a result, the readers could read the already freed buffer (user-after-free). Note that the user-reads don&#39;t race when the same open file is used by the writer, due to kernfs&#39;s open file locking. Nonetheless, doing the reads and writes with separate open files would be common. Fix it by protecting both the user-direct reads and writes with damon_sysfs_lock.</p> https://vulnerability.circl.lu/vuln/cve-2026-46121