CVE-2026-31458: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs: check contexts->nr before accessing contextsarr[0]
Multiple sysfs command paths dereference contextsarr[0] without first verifying that kdamond->contexts->nr == 1. A user can set nrcontexts to 0 via sysfs while DAMON is running, causing NULL pointer dereferences.
In more detail, the issue can be triggered by privileged users like below.
First, start DAMON and make contexts directory empty (kdamond->contexts->nr == 0).
# damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/nrcontexts
Then, each of below commands will cause the NULL pointer dereference.
# echo updateschemesstats > state # echo updateschemestriedregions > state # echo updateschemestriedbytes > state # echo updateschemeseffectivequotas > state # echo updatetunedintervals > state
Guard all commands (except OFF) at the entry point of damonsysfshandlecmd().
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can trigger this issue?
A privileged user who can control DAMON through its sysfs interface can trigger it. The provided example starts DAMON, sets contexts/nr_contexts to 0, and then writes specific update commands to the state file.
What is the impact of successful exploitation?
The affected sysfs command paths can dereference a NULL pointer, causing a denial of service. The supplied severity vector indicates local access, low privileges, no user interaction, and availability impact only.
Which commands are affected after nr_contexts is set to 0?
The listed affected commands are update_schemes_stats, update_schemes_tried_regions, update_schemes_tried_bytes, update_schemes_effective_quotas, and update_tuned_intervals. These commands are issued by writing their names to the DAMON state sysfs file.
What mitigation is available?
A patch is available. The fix guards DAMON sysfs commands other than OFF at the damon_sysfs_handle_cmd() entry point before accessing the first context.