# CVE-2026-72178: mm/damon/core: always put unsuccessfully committed target pids > A memory leak in the Linux kernel DAMON subsystem can lead to resource exhaustion and denial of service when specific commit operations fail. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** An administrator - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 15 Aug 2026 - **Updated:** 17 Aug 2026 - **Also known as:** BELL-CVE-2026-72178, DEBIAN-CVE-2026-72178, GHSA-g93q-9jrc-mrwv, UBUNTU-CVE-2026-72178 ## What is CVE-2026-72178? CVE-2026-72178 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon_commit_target() puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid. It gets the source pid because the caller is supposed to eventually put the pids. In more detail, the caller will call damon_destroy_ctx() after damon_commit_ctx() to destroy the entire source context. And in this case, [f]vaddr operation set's cleanup_target() callback will put the pids. The commit operation is made at the context level. The operation can fail in multiple places including in the middle and after the targets commit operations. For any such failures, immediately the error is returned to the damon_commit_ctx() caller. If some or all of the source target pids were committed to the destination during the unsuccessful context commit attempt, those pids should be put twice. The source context will do the put operations using the above explained routine. However, let's suppose the destination context was not originally using [f]vaddr operation set and the commit failed before the ops of the source context is committed. The destination does not have the cleanup_target() ops callback, so it cannot put the pids via the damon_destroy_ctx(). As a result, the pids are leaked. The issue in the real world would be not very common. The commit feature is for changing parameters of running DAMON context while inheriting internal status like the monitoring results. The monitoring results of a physical address range ain't have things that are beneficial to be inherited to a virtual address ranges monitoring. So the problem-causing DAMON control would be not very common in the real world. That said, it is a supported feature. And damon_commit_target() failure due to memory allocation is relatively realistic [1] if there are a huge number of target regions. Fix by putting the pids in the commit operation in case of the failures. The issue was discovered [2] by Sashiko. ## Which versions are affected by CVE-2026-72178? ## How do I fix CVE-2026-72178? Apply the vendor's patch. ## Is CVE-2026-72178 being exploited? There is no known exploitation of CVE-2026-72178 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-72178 and fix it if it is affected. What it is: CVE-2026-72178 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-72178 in the wild and no public exploit code. Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-72178/ (Markdown: https://insights.sbomify.com/CVE-2026-72178/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-72178 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72178 - OSV: https://osv.dev/vulnerability/CVE-2026-72178 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-72178/ Summaries are generated and may contain mistakes; the official description above is the record.