Skip to main content
VulnerabilityPublished Updated

CVE-2026-64184: Linux kernel · mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in d4e7b5c4cc353f154d5ab8bb2e1ce7714d77a6e9 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:03 UTC

Severity
Low

Rated Low by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none
CISA SSVC
Exploitation
No evidence of active exploitation and no public proof of concept
Automatable
Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact
Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch
Available – fixed in d4e7b5c4cc353f154d5ab8bb2e1ce7714d77a6e9, 082351f9d40007414ad6af062b3a26fa02fd4b5f, 302e02f9ba49f81418ec2a749ae6f5cac1d424e9 +2

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 19 Jul 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ 29cbb9a13f05b20f0777c60db9603730b487a4e0, < d4e7b5c4cc353f154d5ab8bb2e1ce7714d77a6e9
Fixed in
  • d4e7b5c4cc353f154d5ab8bb2e1ce7714d77a6e9
LinuxLinuxAffected
  • ≥ 29cbb9a13f05b20f0777c60db9603730b487a4e0, < 082351f9d40007414ad6af062b3a26fa02fd4b5f
Fixed in
  • 082351f9d40007414ad6af062b3a26fa02fd4b5f
LinuxLinuxAffected
  • ≥ 29cbb9a13f05b20f0777c60db9603730b487a4e0, < 302e02f9ba49f81418ec2a749ae6f5cac1d424e9
Fixed in
  • 302e02f9ba49f81418ec2a749ae6f5cac1d424e9
LinuxLinuxAffected
  • ≥ 29cbb9a13f05b20f0777c60db9603730b487a4e0, < 30a361be33f3793b9ecbd10ab7be6d0564819b79
Fixed in
  • 30a361be33f3793b9ecbd10ab7be6d0564819b79
LinuxLinuxAffected
  • ≥ 29cbb9a13f05b20f0777c60db9603730b487a4e0, < 1bd31386ec3b9ccec10c04429948a306ec5897c0
Fixed in
  • 1bd31386ec3b9ccec10c04429948a306ec5897c0
LinuxLinuxAffected
  • =6.3
Fixed in–

AI-suggested

The issue is fixed in Linux kernel version 6.3. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated.

Description

A vulnerability in the Linux kernel's memory control group (memcg) subsystem was fixed by ensuring the function mem_cgroup_iter_break() is called to properly break iteration loops. The flaw involved the damon_sysfs_memcg_path_to_id() function breaking the mem_cgroup_iter() loop without calling mem_cgroup_iter_break(), causing a reference leak. This issue has been resolved in Linux kernel version 6.3.

References

Community reviews

Loading reviews…