CVE-2026-90006

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

samples/damon/mtier: handle damon_stop() failure

damon_sample_mtier_stop() assumes its damon_stop() call will always

successfully stops the two DAMON contexts. Hence it deallocates the two

DAMON contexts after the damon_stop() call. However, if a given context

is already stopped, damon_stop() fails and returns an error while letting

the DAMON contexts that have not yet stopped keep running. This kind of

unexpected early DAMON context stops could happen due to memory allocation

failures in kdamond_fn(). Because damon_sample_mtier_stop() just

deallocates all DAMON contexts with damon_target and damon_region objects

that are linked to the contexts, the execution of the unstopped DAMON

context (kdamond) ends up using the memory that freed (use-after-free).

Fix the issue by separating the damon_stop() to be invoked per context.

Note that DAMON_SYSFS also allows multiple DAMON contexts execution. But,

it calls damon

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References