Executive brief
A memory leak vulnerability was identified in the Linux kernel's Data Access Monitoring (DAMON) statistics module. When the monitoring service fails to start, the system fails to properly clean up allocated memory, which could lead to gradual resource exhaustion over time if repeated start attempts occur. This primarily impacts system stability and performance rather than direct data security.
Technical details
A memory leak exists in mm/damon/stat.c within the damon_stat_start() function. When damon_start() returns an error, the DAMON context previously allocated by damon_stat_build_ctx() is not destroyed, and the global damon_stat_context pointer is not reset. Subsequent attempts to enable the module overwrite the stale pointer, making the original memory allocation unreachable and permanently leaked. This is a local vulnerability requiring the ability to trigger DAMON start operations. Patches have been merged into the stable kernel tree to ensure damon_destroy_ctx() is called and the pointer is nulled upon failure.
Affected products
- Linux Linux Kernel 6.17.x and later
Timeline
- 2026-03-31: other: Patch submitted by Jackie Liu
- 2026-05-27: disclosed: CVE published