CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error

CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error

damon_sysfs_scheme_add_dirs() setup the tried_regions directory after the
stats directory setup is completed.  When the tried_regions directory
setup is failed, the setup function ensures the reference for the tried
regions directory is released.  Hence the error path should put references
on setup succeeded directory objects, starting from the stats directory. 
However, the error path is putting the tried_regions directory instead of
the stats directory.

As a direct result, the stats directory object is leaked.  Worse yet, if
the tried_regions directory setup failed from the initial allocation, the
scheme->tried_regions field remains uninitialized.  The following
kobject_put(&scheme->tried_regions->kobj) call in the error path will
dereference the uninitialized memory.  The setup failures should not be
common.  But once it happens, the consequence is quite bad.

Fix this issue by correctly putting the stats directory instead of the
tried_regions directory.

The issue was discovered [1] by Sashiko.

The Linux kernel CVE team has assigned CVE-2026-72176 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 6.6.145 with commit 50a753171d255895e5dd41566986b48dcec06f31
	Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 6.12.97 with commit f63d6e5ba72aeacdee4fddc902bd7616cd62b919
	Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 6.18.40 with commit 40a04601a3f66cabd6629c258a07af645a658865
	Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 7.1.5 with commit 6b6b5d7c2c957136b92c00b77b7175259f13082b
	Issue introduced in 6.2 with commit 5181b75f438d2e5b7f27bf48c6ea88a87c2882b7 and fixed in 7.2-rc3 with commit 05ea83ee88ca70f8932906d9f2617ff996f45b50

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72176
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	mm/damon/sysfs-schemes.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/50a753171d255895e5dd41566986b48dcec06f31
	https://git.kernel.org/stable/c/f63d6e5ba72aeacdee4fddc902bd7616cd62b919
	https://git.kernel.org/stable/c/40a04601a3f66cabd6629c258a07af645a658865
	https://git.kernel.org/stable/c/6b6b5d7c2c957136b92c00b77b7175259f13082b
	https://git.kernel.org/stable/c/05ea83ee88ca70f8932906d9f2617ff996f45b50