CVE-2026-72176

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error

damon_sysfs_scheme_add_dirs() setup the tried_regions directory after the

stats directory setup is completed. When the tried_regions directory

setup is failed, the setup function ensures the reference for the tried

regions directory is released. Hence the error path should put references

on setup succeeded directory objects, starting from the stats directory.

However, the error path is putting the tried_regions directory instead of

the stats directory.

As a direct result, the stats directory object is leaked. Worse yet, if

the tried_regions directory setup failed from the initial allocation, the

scheme->tried_regions field remains uninitialized. The following

kobject_put(&scheme->tried_regions->kobj) call in the error path will

dereference the uninitialized memory. The setup failures should not be

common. But once it happens, the consequen

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References