CVE-2022-48996

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in damon_sysfs_set_schemes()

Commit da87878010e5 ("mm/damon/sysfs: support online inputs update") made

'damon_sysfs_set_schemes()' to be called for running DAMON context, which

could have schemes. In the case, DAMON sysfs interface is supposed to

update, remove, or add schemes to reflect the sysfs files. However, the

code is assuming the DAMON context wouldn't have schemes at all, and

therefore creates and adds new schemes. As a result, the code doesn't

work as intended for online schemes tuning and could have more than

expected memory footprint. The schemes are all in the DAMON context, so

it doesn't leak the memory, though.

Remove the wrong asssumption (the DAMON context wouldn't have schemes) in

'damon_sysfs_set_schemes()' to fix the bug.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References