0.0
NA
CVE-2026-72178
mm/damon/core: always put unsuccessfully committed target pids
Description

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon_commit_target() puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid. It gets the source pid because the caller is supposed to eventually put the pids. In more detail, the caller will call damon_destroy_ctx() after damon_commit_ctx() to destroy the entire source context. And in this case, [f]vaddr operation set's cleanup_target() callback will put the pids. The commit operation is made at the context level. The operation can fail in multiple places including in the middle and after the targets commit operations. For any such failures, immediately the error is returned to the damon_commit_ctx() caller. If some or all of the source target pids were committed to the destination during the unsuccessful context commit attempt, those pids should be put twice. The source context will do the put operations using the above explained routine. However, let's suppose the destination context was not originally using [f]vaddr operation set and the commit failed before the ops of the source context is committed. The destination does not have the cleanup_target() ops callback, so it cannot put the pids via the damon_destroy_ctx(). As a result, the pids are leaked. The issue in the real world would be not very common. The commit feature is for changing parameters of running DAMON context while inheriting internal status like the monitoring results. The monitoring results of a physical address range ain't have things that are beneficial to be inherited to a virtual address ranges monitoring. So the problem-causing DAMON control would be not very common in the real world. That said, it is a supported feature. And damon_commit_target() failure due to memory allocation is relatively realistic [1] if there are a huge number of target regions. Fix by putting the pids in the commit operation in case of the failures. The issue was discovered [2] by Sashiko.

INFO

Published Date :

Aug. 15, 2026, 6:21 a.m.

Last Modified :

Aug. 17, 2026, 6:18 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-72178 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
Solution
Fix memory leaks by ensuring target PIDs are put correctly during commit operations.
  • Ensure target PIDs are put when commit operations fail.
  • Update the Linux kernel to incorporate the fix.
  • Apply patches that handle PID put operations on failure.
References to Advisories, Solutions, and Tools
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72178 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72178 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72178 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-72178 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': 'ea07e045611ca00f1ec7e448fd43e655d311158b', 'versionType': 'git'}, {'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': '3b91c35961fa5553b4dd36db1f06e3b4acbfc05d', 'versionType': 'git'}, {'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': '837f619f1d98e967bd63e51ecd1e77bfa468992d', 'versionType': 'git'}, {'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': '6a66c557a2ab2609575bafd15e093669c05f9711', 'versionType': 'git'}], 'programFiles': ['mm/damon/core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['mm/damon/core.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': 'ea07e045611ca00f1ec7e448fd43e655d311158b', 'versionType': 'git'}, {'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': '3b91c35961fa5553b4dd36db1f06e3b4acbfc05d', 'versionType': 'git'}, {'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': '837f619f1d98e967bd63e51ecd1e77bfa468992d', 'versionType': 'git'}, {'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': '6a66c557a2ab2609575bafd15e093669c05f9711', 'versionType': 'git'}], 'programFiles': ['mm/damon/core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['mm/damon/core.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': 'ea07e045611ca00f1ec7e448fd43e655d311158b', 'versionType': 'git'}, {'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': '3b91c35961fa5553b4dd36db1f06e3b4acbfc05d', 'versionType': 'git'}, {'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': '837f619f1d98e967bd63e51ecd1e77bfa468992d', 'versionType': 'git'}, {'status': 'affected', 'version': '83dc7bbaecae6e69e338355e9a137f0e7a0ecc40', 'lessThan': '6a66c557a2ab2609575bafd15e093669c05f9711', 'versionType': 'git'}], 'programFiles': ['mm/damon/core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['mm/damon/core.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon_commit_target() puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid. It gets the source pid because the caller is supposed to eventually put the pids. In more detail, the caller will call damon_destroy_ctx() after damon_commit_ctx() to destroy the entire source context. And in this case, [f]vaddr operation set's cleanup_target() callback will put the pids. The commit operation is made at the context level. The operation can fail in multiple places including in the middle and after the targets commit operations. For any such failures, immediately the error is returned to the damon_commit_ctx() caller. If some or all of the source target pids were committed to the destination during the unsuccessful context commit attempt, those pids should be put twice. The source context will do the put operations using the above explained routine. However, let's suppose the destination context was not originally using [f]vaddr operation set and the commit failed before the ops of the source context is committed. The destination does not have the cleanup_target() ops callback, so it cannot put the pids via the damon_destroy_ctx(). As a result, the pids are leaked. The issue in the real world would be not very common. The commit feature is for changing parameters of running DAMON context while inheriting internal status like the monitoring results. The monitoring results of a physical address range ain't have things that are beneficial to be inherited to a virtual address ranges monitoring. So the problem-causing DAMON control would be not very common in the real world. That said, it is a supported feature. And damon_commit_target() failure due to memory allocation is relatively realistic [1] if there are a huge number of target regions. Fix by putting the pids in the commit operation in case of the failures. The issue was discovered [2] by Sashiko.
    Added Reference https://git.kernel.org/stable/c/3b91c35961fa5553b4dd36db1f06e3b4acbfc05d
    Added Reference https://git.kernel.org/stable/c/6a66c557a2ab2609575bafd15e093669c05f9711
    Added Reference https://git.kernel.org/stable/c/837f619f1d98e967bd63e51ecd1e77bfa468992d
    Added Reference https://git.kernel.org/stable/c/ea07e045611ca00f1ec7e448fd43e655d311158b
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.