From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
Date: Sat, 15 Aug 2026 15:04:15 +0900 [thread overview]
Message-ID: <2026081539-CVE-2026-72176-543c@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
damon_sysfs_scheme_add_dirs() setup the tried_regions directory after the
stats directory setup is completed. When the tried_regions directory
setup is failed, the setup function ensures the reference for the tried
regions directory is released. Hence the error path should put references
on setup succeeded directory objects, starting from the stats directory.
However, the error path is putting the tried_regions directory instead of
the stats directory.
As a direct result, the stats directory object is leaked. Worse yet, if
the tried_regions directory setup failed from the initial allocation, the
scheme->tried_regions field remains uninitialized. The following
kobject_put(&scheme->tried_regions->kobj) call in the error path will
dereference the uninitialized memory. The setup failures should not be
common. But once it happens, the consequence is quite bad.
Fix this issue by correctly putting the stats directory instead of the
tried_regions directory.
The issue was discovered [1] by Sashiko.
The Linux kernel CVE team has assigned CVE-2026-72176 to this issue.
Affected and fixed versions
===========================
Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 6.6.145 with commit 50a753171d255895e5dd41566986b48dcec06f31
Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 6.12.97 with commit f63d6e5ba72aeacdee4fddc902bd7616cd62b919
Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 6.18.40 with commit 40a04601a3f66cabd6629c258a07af645a658865
Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 7.1.5 with commit 6b6b5d7c2c957136b92c00b77b7175259f13082b
Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 7.2-rc3 with commit 05ea83ee88ca70f8932906d9f2617ff996f45b50
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-72176
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
mm/damon/sysfs-schemes.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/50a753171d255895e5dd41566986b48dcec06f31
https://git.kernel.org/stable/c/f63d6e5ba72aeacdee4fddc902bd7616cd62b919
https://git.kernel.org/stable/c/40a04601a3f66cabd6629c258a07af645a658865
https://git.kernel.org/stable/c/6b6b5d7c2c957136b92c00b77b7175259f13082b
https://git.kernel.org/stable/c/05ea83ee88ca70f8932906d9f2617ff996f45b50
reply other threads:[~2026-08-15 6:14 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026081539-CVE-2026-72176-543c@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.