CVE-2026-72178

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: always put unsuccessfully committed target pids

damon_commit_target() puts and gets the destination and the source target

pids. It puts the destination target pid because it will be overwritten

by the source target pid. It gets the source pid because the caller is

supposed to eventually put the pids. In more detail, the caller will call

damon_destroy_ctx() after damon_commit_ctx() to destroy the entire source

context. And in this case, [f]vaddr operation set's cleanup_target()

callback will put the pids.

The commit operation is made at the context level. The operation can fail

in multiple places including in the middle and after the targets commit

operations. For any such failures, immediately the error is returned to

the damon_commit_ctx() caller. If some or all of the source target pids

were committed to the destination during the unsuccessful context commit

attempt, those pids should be put twice.

The source context will do the put operations using the above explained

routine. However, let's suppose the destination context was not

originally using [f]vaddr operation set and the commit failed before the

ops of the source context is committed. The destination does not have the

cleanup_target() ops callback, so it cannot put the pids via the

damon_destroy_ctx().

As a result, the pids are leaked. The issue in the real world would be

not very common. The commit feature is for changing parameters of running

DAMON context while inheriting internal status like the monitoring

results. The monitoring results of a physical address range ain't have

things that are beneficial to be inherited to a virtual address ranges

monitoring. So the problem-causing DAMON control would be not very common

in the real world. That said, it is a supported feature. And

damon_commit_target() failure due to memory allocation is relatively

realistic [1] if there are a huge number of target regions.

Fix by putting the pids in the commit operation in case of the failures.

The issue was discovered [2] by Sashiko.