CVE-2026-23144: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23144 is a memory leak and resource exhaustion vulnerability in the Linux kernel's DAMON (Data Access Monitoring) sysfs interface. When a context DAMON sysfs directory setup fails after the attrs/ subdirectory has already been created, the subdirectories under attrs/ are not properly cleaned up, leaving the DAMON sysfs interface nearly unusable until system reboot and leaking memory from unremoved directories. It affects Linux kernel versions from 5.18 through 6.19-rc5, specifically 6.1.x before 6.1.162, 6.2.x–6.6.x before 6.6.122, 6.7.x–6.12.x before 6.12.67, and 6.13.x–6.18.x before 6.18.7. The vulnerability was published on February 14, 2026, with patches released on March 17, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the mm/damon/sysfs subsystem of the Linux kernel. When the context directory setup routine encounters a failure after successfully creating the attrs/ subdirectory and its children, the error-handling path does not invoke the necessary cleanup functions to remove those already-created subdirectories. This results in dangling sysfs directory entries and unreleased kernel memory. Exploitation requires local access with low privileges — an attacker can repeatedly trigger the failure condition to accumulate memory leaks and render the DAMON sysfs interface non-functional (Feedly, Kernel Patches).

Successful exploitation causes a denial-of-service condition: the DAMON sysfs interface becomes nearly broken and unresponsive, requiring a full system reboot to restore normal functionality. Repeated triggering of the vulnerability leads to progressive memory exhaustion through accumulated kernel memory leaks from unremoved sysfs directory objects. There is no confidentiality or integrity impact — the vulnerability is limited to availability of the DAMON subsystem and, under sustained exploitation, broader system stability (Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges, limiting its attack surface to authenticated local users or processes. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Update the Linux kernel to a patched version: 6.1.162 or later (for the 6.1.x branch), 6.6.122 or later (for the 6.6.x branch), 6.12.67 or later (for the 6.12.x branch), or 6.18.7 or later (for the 6.18.x branch). Downstream distributions including Red Hat (RHSA-2026:6632, RHSA-2026:8342, RHSA-2026:9112, RHSA-2026:9512, RHSA-2026:9644, RHSA-2026:10108), Rocky Linux (RLSA-2026:6153, RLSA-2026:6632), Oracle Linux, AlmaLinux, and Ubuntu (USN-8393-1) have issued kernel update advisories. As a workaround where patching is not immediately possible, restrict local user access to DAMON-related sysfs nodes (e.g., via filesystem permissions) or disable DAMON functionality if it is not required for the deployment (Feedly, Red Hat Advisory).

The vulnerability has been addressed by multiple major Linux distributions including Red Hat, Rocky Linux, Oracle Linux, AlmaLinux, and Ubuntu, each issuing kernel security advisories. Detection coverage has been added by Tenable (Nessus) and Qualys scanners. No notable independent researcher commentary or significant social media discussion has been identified beyond routine distribution advisory tracking (Feedly, Red Hat Advisory).