Executive brief
A vulnerability in the Linux kernel's memory monitoring subsystem (DAMON) could allow a local user with certain privileges to crash the system. By manipulating specific system files while the monitoring tool is active, an attacker can trigger a system failure (NULL pointer dereference). This results in a denial-of-service condition, impacting the availability of the affected server or workstation.
Technical details
A NULL pointer dereference vulnerability exists in mm/damon/sysfs.c within the Linux kernel. Multiple sysfs command paths in damon_sysfs_handle_cmd() dereference the first element of the contexts array (contexts_arr[0]) without verifying that the number of contexts (nr) is non-zero. A privileged local attacker can set nr_contexts to 0 via sysfs while DAMON is running and then issue commands like update_schemes_stats to trigger the crash. The issue has been resolved by adding a check for kdamond->contexts->nr != 1 at the entry point of the command handler.
Affected products
- Linux Linux Kernel 5.18 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11
Timeline
- 2026-03-21: other: Patch authored
- 2026-04-22: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615
- https://git.kernel.org/stable/c/1e8da792672481d603fa7cd0d815577220a3ee27
- https://git.kernel.org/stable/c/708033c231bd782858f4ddbb46ee874a5a5fbdab
- https://git.kernel.org/stable/c/aba546061341b56e9ffb37e1eb661a3628b6ec12
- https://git.kernel.org/stable/c/bbe03ad3fb9e714191757ca7b41582f930be7be2