CVE-2026-31459
Memory Leak and NULL Dereference in Linux Kernel DAMON_SYSFS
Publication date: 2026-04-22
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.18.1 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | 6.17.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by a patch in the Linux kernel that fixes memory leaks and NULL pointer dereference issues in the DAMON_SYSFS subsystem. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this patch.
- Apply the patch series "mm/damon/sysfs: fix memory leak and NULL dereference issues", v4, or upgrade to a kernel version that contains this fix.
- Avoid running privileged user operations that involve DAMON_SYSFS with incorrect control sequences until the patch is applied.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's DAMON_SYSFS component. It involves a memory leak and a NULL pointer dereference that occur when a privileged user performs incorrect sequences of control. Specifically, when the function damon_sysfs_new_test_ctx() fails during damon_sysfs_commit_input(), a parameter context (param_ctx) is leaked because the cleanup code is skipped due to an early return. This can lead to resource leaks and potential crashes.
How can this vulnerability impact me? :
The vulnerability can cause memory leaks and NULL pointer dereferences in the Linux kernel, which may lead to system instability or crashes. Since it requires privileged user actions to trigger, it could potentially be exploited to disrupt system operations or degrade performance by exhausting memory resources.