{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90006 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90006 is an use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90006 and fix it if it is affected.\n\nWhat it is: CVE-2026-90006 is an use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90006 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90006/ (Markdown: https://insights.sbomify.com/CVE-2026-90006/index.md)","id":"CVE-2026-90006","markdown":"https://insights.sbomify.com/CVE-2026-90006/index.md","name":"CVE-2026-90006","record":{"aliases":["BELL-CVE-2026-90006","DEBIAN-CVE-2026-90006","GHSA-vfcg-xg68-fq77","UBUNTU-CVE-2026-90006"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free vulnerability in the Linux kernel DAMON mtier sample allows local attackers to execute arbitrary code or escalate privileges.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/damon/mtier: handle damon_stop() failure\n\ndamon_sample_mtier_stop() assumes its damon_stop() call will always\nsuccessfully stops the two DAMON contexts.  Hence it deallocates the two\nDAMON contexts after the damon_stop() call.  However, if a given context\nis already stopped, damon_stop() fails and returns an error while letting\nthe DAMON contexts that have not yet stopped keep running.  This kind of\nunexpected early DAMON context stops could happen due to memory allocation\nfailures in kdamond_fn().  Because damon_sample_mtier_stop() just\ndeallocates all DAMON contexts with damon_target and damon_region objects\nthat are linked to the contexts, the execution of the unstopped DAMON\ncontext (kdamond) ends up using the memory that freed (use-after-free). \nFix the issue by separating the damon_stop() to be invoked per context.\n\nNote that DAMON_SYSFS also allows multiple DAMON contexts execution.  But,\nit calls damon_stop() for each context one by one.  Hence this issue is\nonly in mtier.\n\nFor the long term, it would be better to refactor damon_stop() to always\nensure stopping all contexts regardless of the failures in the middle. \nMake this fix in the current way, though, to keep it simple and easy to\nbackport.  I will do the refactoring later.\n\nThe issue was discovered [1] by Sashiko.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"samples/damon/mtier: handle damon_stop() failure","id":"CVE-2026-90006","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"scsi: pm8001: Use rollback index when freeing MSI-X vectors","id":"CVE-2026-90007"},"packages":[],"prev":{"headline":"samples/damon/wsse: handle damon_start() failure","id":"CVE-2026-90005"},"products":["Linux"],"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel DAMON mtier sample allows local attackers to execute arbitrary code or escalate privileges.","url":"https://insights.sbomify.com/CVE-2026-90006/"}