Use-After-Free Vulnerability in Linux Kernel Affecting DAMON Contexts

CVE-2026-90006

What is CVE-2026-90006?

A use-after-free vulnerability exists in the Linux kernel's DAMON module, specifically in the mtier sample. The issue arises when the damon_sample_mtier_stop() function assumes that the damon_stop() call will successfully stop all DAMON contexts. If a DAMON context is already stopped, the call fails, leading to potential exploitation risks as ongoing execution may utilize freed memory. This behavior can be triggered by memory allocation failures within the kdamond_fn() context. The vulnerability underscores the need for better management of context stopping procedures within the DAMON subsystem.

References