Executive brief
A vulnerability was identified in the Linux kernel's memory management component (DAMON_RECLAIM). Under rare conditions where the system runs out of memory during specific initialization tasks, the kernel could attempt to use a non-existent memory address, leading to a system crash. This primarily affects system stability and availability.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's mm/damon/reclaim.c and mm/damon/lru_sort.c components. The issue occurs because damon_reclaim_enabled_store() assumes that the damon_ctx object allocation in the initialization function always succeeds. If the allocation fails due to memory pressure, subsequent calls to damon_commit_ctx() dereference the NULL 'ctx' pointer. This is a local vulnerability that can lead to a kernel oops or system crash. Patches have been released for stable kernel branches including 6.18.x and 7.0.x.
Affected products
- Linux Linux Kernel 6.18 to 6.18.36, 7.0 to 7.0.13
Timeline
- 2026-07-01: advisory
- 2026-06-19: patched