CVE-2026-72178: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-g93q-9jrc-mrwv
Share
Published
Advisory Summary

CVE-2026-72178 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72178 at a Glance

CVE Identifier CVE-2026-72178
GHSA Identifier GHSA-g93q-9jrc-mrwv
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-72178

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72178, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon_commit_target() puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid. It gets the source pid because the caller is supposed to eventually put the pids. In more detail, the caller will call damon_destroy_ctx() after damon_commit_ctx() to destroy the entire source context. And in this case, [f]vaddr operation set's cleanup_target() callback will put the pids. The commit operation is made at the context level. The operation can fail in multiple places including in the middle and after the targets commit operations. For any such failures, immediately the error is returned to the damon_commit_ctx() caller. If some or all of the source target pids were committed to the destination during the unsuccessful context commit attempt, those pids should be put twice. The source context will do the put operations using the above explained routine. However, let's suppose the destination context was not originally using [f]vaddr operation set and the commit failed before the ops of the source context is committed. The destination does not have the cleanup_target() ops callback, so it cannot put the pids via the damon_destroy_ctx(). As a result, the pids are leaked. The issue in the real world would be not very common. The commit feature is for changing parameters of running DAMON context while inheriting internal status like the monitoring results. The monitoring results of a physical address range ain't have things that are beneficial to be inherited to a virtual address ranges monitoring. So the problem-causing DAMON control would be not very common in the real world. That said, it is a supported feature. And damon_commit_target() failure due to memory allocation is relatively realistic [1] if there are a huge number of target regions. Fix by putting the pids in the commit operation in case of the failures. The issue was discovered [2] by Sashiko.

References

NVD — CVE-2026-72178 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72178
git.kernel.org/stable/c/3b91c35961... WEB
https://git.kernel.org/stable/c/3b91c35961fa5553b4dd36db1f06e3b4acbfc05d
git.kernel.org/stable/c/6a66c557a2... WEB
https://git.kernel.org/stable/c/6a66c557a2ab2609575bafd15e093669c05f9711
git.kernel.org/stable/c/837f619f1d... WEB
https://git.kernel.org/stable/c/837f619f1d98e967bd63e51ecd1e77bfa468992d
git.kernel.org/stable/c/ea07e04561... WEB
https://git.kernel.org/stable/c/ea07e045611ca00f1ec7e448fd43e655d311158b

Frequently Asked Questions

What is CVE-2026-72178?
CVE-2026-72178 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72178?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-72178?
CVE-2026-72178 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72178?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g93q-9jrc-mrwv",
  "modified" : "2026-08-15T06:32:15Z",
  "published" : "2026-08-15T06:32:14Z",
  "aliases" : [ "CVE-2026-72178" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: always put unsuccessfully committed target pids\n\ndamon_commit_target() puts and gets the destination and the source target\npids.  It puts the destination target pid because it will be overwritten\nby the source target pid.  It gets the source pid because the caller is\nsupposed to eventually put the pids.  In more detail, the caller will call\ndamon_destroy_ctx() after damon_commit_ctx() to destroy the entire source\ncontext.  And in this case, [f]vaddr operation set's cleanup_target()\ncallback will put the pids.\n\nThe commit operation is made at the context level.  The operation can fail\nin multiple places including in the middle and after the targets commit\noperations.  For any such failures, immediately the error is returned to\nthe damon_commit_ctx() caller.  If some or all of the source target pids\nwere committed to the destination during the unsuccessful context commit\nattempt, those pids should be put twice.\n\nThe source context will do the put operations using the above explained\nroutine.  However, let's suppose the destination context was not\noriginally using [f]vaddr operation set and the commit failed before the\nops of the source context is committed.  The destination does not have the\ncleanup_target() ops callback, so it cannot put the pids via the\ndamon_destroy_ctx().\n\nAs a result, the pids are leaked.  The issue in the real world would be\nnot very common.  The commit feature is for changing parameters of running\nDAMON context while inheriting internal status like the monitoring\nresults.  The monitoring results of a physical address range ain't have\nthings that are beneficial to be inherited to a virtual address ranges\nmonitoring.  So the problem-causing DAMON control would be not very common\nin the real world.  That said, it is a supported feature.  And\ndamon_commit_target() failure due to memory allocation is relatively\nrealistic [1] if there are a huge number of target regions.\n\nFix by putting the pids in the commit operation in case of the failures.\n\nThe issue was discovered [2] by Sashiko.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72178"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3b91c35961fa5553b4dd36db1f06e3b4acbfc05d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6a66c557a2ab2609575bafd15e093669c05f9711"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/837f619f1d98e967bd63e51ecd1e77bfa468992d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ea07e045611ca00f1ec7e448fd43e655d311158b"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:36Z"
  }
}