The Linux kernel contained a vulnerability in the mm/damon/sysfs-schemes component where the path pointer (damon_sysfs_quot_goal->path) could be read and written by users via the DAMON sysfs 'path' file without proper locking. While parameter commits were protected by damon_sysfs_lock, direct user reads and writes were not, leading to a use-after-free condition when the write operation deallocated the path buffer. This could allow readers to access freed memory if they use separate open files, causing potential memory corruption. The issue was fixed by protecting both user reads and writes with damon_sysfs_lock. The vulnerability affects Linux kernel versions prior to 7.0.0-28.28 and related variants.

The vulnerability allows local users with limited privileges to cause a use-after-free condition by reading a freed buffer in the DAMON sysfs interface. This can lead to memory corruption, potentially impacting system confidentiality, integrity, and availability. The CVSS score of 7.8 reflects a high severity with local attack vector, low complexity, and no user interaction required. There are no known exploits in the wild at this time.

A patch is available and should be applied by updating to Linux kernel versions 7.0.0-28.28 or later (and corresponding fixed versions for related builds). After applying the update, a system reboot is required. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow vendor instructions for upgrading and recompiling kernel modules to fully remediate the issue.