CVE-2024-57886
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
15/01/2025
Last modified:
26/09/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
mm/damon/core: fix new damon_target objects leaks on damon_commit_targets()<br />
<br />
Patch series "mm/damon/core: fix memory leaks and ignored inputs from<br />
damon_commit_ctx()".<br />
<br />
Due to two bugs in damon_commit_targets() and damon_commit_schemes(),<br />
which are called from damon_commit_ctx(), some user inputs can be ignored,<br />
and some mmeory objects can be leaked. Fix those.<br />
<br />
Note that only DAMON sysfs interface users are affected. Other DAMON core<br />
API user modules that more focused more on simple and dedicated production<br />
usages, including DAMON_RECLAIM and DAMON_LRU_SORT are not using the buggy<br />
function in the way, so not affected.<br />
<br />
<br />
This patch (of 2):<br />
<br />
When new DAMON targets are added via damon_commit_targets(), the newly<br />
created targets are not deallocated when updating the internal data<br />
(damon_commit_target()) is failed. Worse yet, even if the setup is<br />
successfully done, the new target is not linked to the context. Hence,<br />
the new targets are always leaked regardless of the internal data setup<br />
failure. Fix the leaks.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.11 (including) | 6.12.9 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



