CVE-2026-31458: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs: check contexts->nr before accessing contextsarr[0]
Multiple sysfs command paths dereference contextsarr[0] without first verifying that kdamond->contexts->nr == 1. A user can set nrcontexts to 0 via sysfs while DAMON is running, causing NULL pointer dereferences.
In more detail, the issue can be triggered by privileged users like below.
First, start DAMON and make contexts directory empty (kdamond->contexts->nr == 0).
# damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/nrcontexts
Then, each of below commands will cause the NULL pointer dereference.
# echo updateschemesstats > state # echo updateschemestriedregions > state # echo updateschemestriedbytes > state # echo updateschemeseffectivequotas > state # echo updatetunedintervals > state
Guard all commands (except OFF) at the entry point of damonsysfshandlecmd().