CVE-2026-72177

A flaw was found in the Linux kernel's memory management subsystem (DAMON). Incorrect handling of directory references during error conditions in specific functions can lead to an uninitialized memory dereference or a memory leak. This vulnerability could potentially cause system instability or unauthorized information disclosure.

DAMON sysfs access pattern setup used the wrong cleanup order in an error path. If directory creation failed early, the cleanup code could call kobject_put on an access_pattern field that was not initialized, causing an uninitialized pointer dereference or leaking references. For the CVSS the PR:L is used for the paranoid score because a less privileged local actor may be relevant in environments where DAMON sysfs control is delegated through a service, container, or reduced capability admin path. The realistic trigger requires local control of DAMON sysfs and a rare allocation failure, so AC:H is appropriate. Impact is at least local denial of service via kernel crash and in worst case may allow limited confidentiality or integrity impact due to invalid kernel object lifetime handling.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.