In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error damon_sysfs_scheme_add_dirs() setup the tried_regions directory after the stats directory setup is completed. When the tried_regions directory setup is failed, the setup function ensures the reference for the tried regions directory is released. Hence the error path should put references on setup succeeded directory objects, starting from the stats directory. However, the error path is putting the tried_regions directory instead of the stats directory. As a direct result, the stats directory object is leaked. Worse yet, if the tried_regions directory setup failed from the initial allocation, the scheme->tried_regions field remains uninitialized. The following kobject_put(&scheme->tried_regions->kobj) call in the error path will dereference the uninitialized memory. The setup failures should not be common. But once it happens, the consequence is quite bad. Fix this issue by correctly putting the stats directory instead of the tried_regions directory. The issue was discovered [1] by Sashiko.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error damon_sysfs_scheme_add_dirs() setup     the tried_regions directory after the stats directory setup is completed. When the tried_regions directory     setup is failed, the setup function ensures the reference for the tried regions directory is released.
    Hence the error path should put references on setup succeeded directory objects, starting from the stats     directory. However, the error path is putting the tried_regions directory instead of the stats directory.
    As a direct result, the stats directory object is leaked. Worse yet, if the tried_regions directory setup     failed from the initial allocation, the scheme->tried_regions field remains uninitialized. The following     kobject_put(&scheme->tried_regions->kobj) call in the error path will dereference the uninitialized     memory. The setup failures should not be common. But once it happens, the consequence is quite bad. Fix     this issue by correctly putting the stats directory instead of the tried_regions directory. The issue was     discovered [1] by Sashiko. (CVE-2026-72176)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Type	Severity
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365525	Ubuntu 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8918-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	Local	high
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
341880	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2071)	Nessus	Amazon Linux Local Security Checks	Local	high
337812	Linux Distros Unpatched Vulnerability : CVE-2026-72176	Nessus	Misc.	Local	medium
337239	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2057)	Nessus	Amazon Linux Local Security Checks	Local	high
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-72176

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

high

high

medium

high

high