Linux kernel damon_stat_start UAF & memory leak
CVE-2026-31652 Published on April 24, 2026
mm/damon/stat: deallocate damon_call() failure leaking damon_ctx
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/stat: deallocate damon_call() failure leaking damon_ctx
damon_stat_start() always allocates the module's damon_ctx object
(damon_stat_context). Meanwhile, if damon_call() in the function fails,
the damon_ctx object is not deallocated. Hence, if the damon_call() is
failed, and the user writes Y to enabled again, the previously
allocated damon_ctx object is leaked.
This cannot simply be fixed by deallocating the damon_ctx object when
damon_call() fails. That's because damon_call() failure doesn't guarantee
the kdamond main function, which accesses the damon_ctx object, is
completely finished. In other words, if damon_stat_start() deallocates
the damon_ctx object after damon_call() failure, the not-yet-terminated
kdamond could access the freed memory (use-after-free).
Fix the leak while avoiding the use-after-free by keeping returning
damon_stat_start() without deallocating the damon_ctx object after
damon_call() failure, but deallocating it when the function is invoked
again and the kdamond is completely terminated. If the kdamond is not yet
terminated, simply return -EAGAIN, as the kdamond will soon be terminated.
The issue was discovered [1] by sashiko.
Products Associated with CVE-2026-31652
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8 and below 447f8870b484f6596d7a7130e72bd0a3f1e037bb is affected.
- Version 405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8 and below 16c92e9bf55fa049ddb5e894dc0623dacd46a620 is affected.
- Version 405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8 and below 4c04c6b47c361612b1d70cec8f7a60b1482d1400 is affected.
- Version 6.17 is affected.
- Before 6.17 is unaffected.
- Version 6.18.23, <= 6.18.* is unaffected.
- Version 6.19.13, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.