{"api_version":"1","generated_at":"2026-05-28T23:04:41+00:00","cve":"CVE-2026-46121","urls":{"html":"https://cve.report/CVE-2026-46121","api":"https://cve.report/api/cve/CVE-2026-46121.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-46121","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-46121"},"summary":{"title":"mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock\n\nPatch series \"mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path\".\n\nReads of 'memcg_path' and 'path' files in DAMON sysfs interface could race\nwith their writes, results in use-after-free.  Fix those.\n\n\nThis patch (of 2):\n\ndamon_sysfs_scheme_filter->mmecg_path can be read and written by users,\nvia DAMON sysfs memcg_path file.  It can also be indirectly read, for the\nparameters {on,off}line committing to DAMON.  The reads for parameters\ncommitting are protected by damon_sysfs_lock to avoid the sysfs files\nbeing destroyed while any of the parameters are being read.  But the\nuser-driven direct reads and writes are not protected by any lock, while\nthe write is deallocating the memcg_path-pointing buffer.  As a result,\nthe readers could read the already freed buffer (user-after-free).  Note\nthat the user-reads don't race when the same open file is used by the\nwriter, due to kernfs's open file locking.  Nonetheless, doing the reads\nand writes with separate open files would be common.  Fix it by protecting\nboth the user-direct reads and writes with damon_sysfs_lock.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-05-28 10:16:27","updated_at":"2026-05-28 13:44:01"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/c88802d0e8edd14b6cd2daf3000f99adbc4c85c5","name":"https://git.kernel.org/stable/c/c88802d0e8edd14b6cd2daf3000f99adbc4c85c5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b1e9f2d5870776347edef927f9bb3ea19b8e3abb","name":"https://git.kernel.org/stable/c/b1e9f2d5870776347edef927f9bb3ea19b8e3abb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1e68eb96e8beb1abefd12dd22c5637795d8a877e","name":"https://git.kernel.org/stable/c/1e68eb96e8beb1abefd12dd22c5637795d8a877e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/baecc45ad60e621ef14d6c1e7f41ef36bbfdf910","name":"https://git.kernel.org/stable/c/baecc45ad60e621ef14d6c1e7f41ef36bbfdf910","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/eafd6f5372d29b0dd213799b92c2c9c7ad31d7da","name":"https://git.kernel.org/stable/c/eafd6f5372d29b0dd213799b92c2c9c7ad31d7da","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46121","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46121","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 490a43d07f1663d827e802720d30cbc0494e4f81 b1e9f2d5870776347edef927f9bb3ea19b8e3abb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c5d5b0047b0c0f304608f3824139f7bd34c48413 c88802d0e8edd14b6cd2daf3000f99adbc4c85c5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4f489fe6afb395dbc79840efa3c05440b760d883 eafd6f5372d29b0dd213799b92c2c9c7ad31d7da git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4f489fe6afb395dbc79840efa3c05440b760d883 baecc45ad60e621ef14d6c1e7f41ef36bbfdf910 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4f489fe6afb395dbc79840efa3c05440b760d883 1e68eb96e8beb1abefd12dd22c5637795d8a877e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4a158ac0538dd5695eeaa00aa0720d711f3e4ef1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.96 6.6.140 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.36 6.12.88 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.15.5 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.16","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.140 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.88 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.30 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.7 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1-rc2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/sysfs-schemes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b1e9f2d5870776347edef927f9bb3ea19b8e3abb","status":"affected","version":"490a43d07f1663d827e802720d30cbc0494e4f81","versionType":"git"},{"lessThan":"c88802d0e8edd14b6cd2daf3000f99adbc4c85c5","status":"affected","version":"c5d5b0047b0c0f304608f3824139f7bd34c48413","versionType":"git"},{"lessThan":"eafd6f5372d29b0dd213799b92c2c9c7ad31d7da","status":"affected","version":"4f489fe6afb395dbc79840efa3c05440b760d883","versionType":"git"},{"lessThan":"baecc45ad60e621ef14d6c1e7f41ef36bbfdf910","status":"affected","version":"4f489fe6afb395dbc79840efa3c05440b760d883","versionType":"git"},{"lessThan":"1e68eb96e8beb1abefd12dd22c5637795d8a877e","status":"affected","version":"4f489fe6afb395dbc79840efa3c05440b760d883","versionType":"git"},{"status":"affected","version":"4a158ac0538dd5695eeaa00aa0720d711f3e4ef1","versionType":"git"},{"lessThan":"6.6.140","status":"affected","version":"6.6.96","versionType":"semver"},{"lessThan":"6.12.88","status":"affected","version":"6.12.36","versionType":"semver"},{"lessThan":"6.16","status":"affected","version":"6.15.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/sysfs-schemes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.88","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.30","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1-rc2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.140","versionStartIncluding":"6.6.96","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.88","versionStartIncluding":"6.12.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.30","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.7","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1-rc2","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock\n\nPatch series \"mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path\".\n\nReads of 'memcg_path' and 'path' files in DAMON sysfs interface could race\nwith their writes, results in use-after-free.  Fix those.\n\n\nThis patch (of 2):\n\ndamon_sysfs_scheme_filter->mmecg_path can be read and written by users,\nvia DAMON sysfs memcg_path file.  It can also be indirectly read, for the\nparameters {on,off}line committing to DAMON.  The reads for parameters\ncommitting are protected by damon_sysfs_lock to avoid the sysfs files\nbeing destroyed while any of the parameters are being read.  But the\nuser-driven direct reads and writes are not protected by any lock, while\nthe write is deallocating the memcg_path-pointing buffer.  As a result,\nthe readers could read the already freed buffer (user-after-free).  Note\nthat the user-reads don't race when the same open file is used by the\nwriter, due to kernfs's open file locking.  Nonetheless, doing the reads\nand writes with separate open files would be common.  Fix it by protecting\nboth the user-direct reads and writes with damon_sysfs_lock."}],"providerMetadata":{"dateUpdated":"2026-05-28T09:35:36.292Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b1e9f2d5870776347edef927f9bb3ea19b8e3abb"},{"url":"https://git.kernel.org/stable/c/c88802d0e8edd14b6cd2daf3000f99adbc4c85c5"},{"url":"https://git.kernel.org/stable/c/eafd6f5372d29b0dd213799b92c2c9c7ad31d7da"},{"url":"https://git.kernel.org/stable/c/baecc45ad60e621ef14d6c1e7f41ef36bbfdf910"},{"url":"https://git.kernel.org/stable/c/1e68eb96e8beb1abefd12dd22c5637795d8a877e"}],"title":"mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-46121","datePublished":"2026-05-28T09:35:36.292Z","dateReserved":"2026-05-13T15:03:33.098Z","dateUpdated":"2026-05-28T09:35:36.292Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-28 10:16:27","lastModifiedDate":"2026-05-28 13:44:01","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"46121","Ordinal":"1","Title":"mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sy","CVE":"CVE-2026-46121","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"46121","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock\n\nPatch series \"mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path\".\n\nReads of 'memcg_path' and 'path' files in DAMON sysfs interface could race\nwith their writes, results in use-after-free.  Fix those.\n\n\nThis patch (of 2):\n\ndamon_sysfs_scheme_filter->mmecg_path can be read and written by users,\nvia DAMON sysfs memcg_path file.  It can also be indirectly read, for the\nparameters {on,off}line committing to DAMON.  The reads for parameters\ncommitting are protected by damon_sysfs_lock to avoid the sysfs files\nbeing destroyed while any of the parameters are being read.  But the\nuser-driven direct reads and writes are not protected by any lock, while\nthe write is deallocating the memcg_path-pointing buffer.  As a result,\nthe readers could read the already freed buffer (user-after-free).  Note\nthat the user-reads don't race when the same open file is used by the\nwriter, due to kernfs's open file locking.  Nonetheless, doing the reads\nand writes with separate open files would be common.  Fix it by protecting\nboth the user-direct reads and writes with damon_sysfs_lock.","Type":"Description","Title":"mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sy"}]}}}