CVE-2026-31457
Null Pointer Dereference in Linux Kernel DAMON sysfs Component
Publication date: 2026-04-22
Last updated on: 2026-05-05
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.17 (inc) to 6.18.21 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's DAMON subsystem, specifically in the damon_sysfs_repeat_call_fn function. The function calls several update functions without checking the number of contexts (contexts->nr). If the number of contexts (nr_contexts) is set to 0 via the sysfs interface while DAMON is running, the functions attempt to dereference contexts_arr[0], which leads to a NULL pointer dereference.
This can cause the kernel to crash or behave unpredictably. The issue arises because the code lacks a check for zero contexts before accessing the array.
How can this vulnerability impact me? :
This vulnerability can cause a NULL pointer dereference in the Linux kernel, which may lead to a kernel crash or system instability. If exploited or triggered, it could result in denial of service by causing the system to crash or reboot unexpectedly.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the issue using the DAMON sysfs interface and the DAMON user-space tool (damo). Specifically, you can start the damo tool with a refresh interval and then set the nr_contexts to 0 via sysfs to check for a NULL pointer dereference.
- Run the command: sudo damo start --refresh_interval 1s
- Then execute: echo 0 | sudo tee /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the Linux kernel is updated to a version where the missing check for contexts->nr in damon_sysfs_repeat_call_fn() has been added. This prevents the NULL pointer dereference when nr_contexts is set to 0.
Until the update is applied, avoid setting nr_contexts to 0 via the DAMON sysfs interface while DAMON is running.