Executive brief
A vulnerability in the Linux kernel's memory monitoring subsystem (DAMON) could allow a local user to crash the system. By manipulating specific system files while the monitoring tool is active, an attacker can trigger a kernel failure. This results in a complete system outage, impacting service availability.
Technical details
A NULL pointer dereference exists in mm/damon/sysfs.c within the damon_sysfs_repeat_call_fn() function. The vulnerability is triggered when the 'nr_contexts' value is set to 0 via the sysfs interface while DAMON is active, causing subsequent calls to damon_sysfs_upd_tuned_intervals(), damon_sysfs_upd_schemes_stats(), and damon_sysfs_upd_schemes_effective_quotas() to dereference an empty contexts_arr[0]. An attacker with local access to the sysfs interface can exploit this to cause a kernel panic. Patches have been released for stable kernel branches including 6.18.y and 6.19.y.
Affected products
- Linux Linux Kernel 6.17 to 6.18.21, 6.19 to 6.19.11, 7.0-rc1 to 7.0-rc5
Timeline
- 2026-03-21: other: Vulnerability fixed in source code
- 2026-04-22: disclosed: CVE published