CVE-2021-46937: mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()'

Vulnerability summary

CVE-2021-46937 is a medium (CVSS 5.5) Exposure of Resource to Wrong Sphere vulnerability in linux. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.8% of scored vulnerabilities.

Timeline

1. 27-02-2024
   PublishedVulnerability first disclosed.
2. 11-05-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' DAMON debugfs interface increases the reference counts of 'struct pid's for targets from the 'target_ids' file write callback ('dbgfs_target_ids_write()'), but decreases the counts only in DAMON monitoring termination callback ('dbgfs_before_terminate()'). Therefore, when 'target_ids' file is repeatedly written without DAMON monitoring start/termination, the reference count is not decreased and therefore memory for the 'struct pid' cannot be freed. This commit fixes this issue by decreasing the reference counts when 'target_ids' is written.

• CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.