CVE-2026-46008: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: fix damoswalk() vs kdamondfn() exit race
When kdamondfn() main loop is finished, the function cancels remaining damoswalk() request and unset the damonctx->kdamond so that API callers and API functions themselves can show the context is terminated. damoswalk() adds the caller's request to the queue first. After that, it shows if the kdamond of the damonctx is still running (damonctx->kdamond is set). Only if the kdamond is running, damoswalk() starts waiting for the kdamond's handling of the newly added request.
The damoswalk() requests registration and damonctx->kdamond unset are protected by different mutexes, though. Hence, damoswalk() could race with damonctx->kdamond unset, and result in deadlocks.
For example, let's suppose kdamond successfully finished the damowwalk() request cancelling. Right after that, damoswalk() is called for the context. It registers the new request, and shows the context is still running, because damonctx->kdamond unset is not yet done. Hence the damoswalk() caller starts waiting for the handling of the request. However, the kdamond is already on the termination steps, so it never handles the new request. As a result, the damoswalk() caller thread infinitely waits.
Fix this by introducing another damonctx field, namely walkcontrolobsolete. It is protected by the damonctx->walkcontrollock, which protects damoswalk() request registration. Initialize (unset) it in kdamondfn() before letting damonstart() returns and set it just before the cancelling of the remaining damoswalk() request is executed. damoswalk() reads the obsolete field under the lock and avoids adding a new request.
After this change, only requests that are guaranteed to be handled or cancelled are registered. Hence the after-registration DAMON context termination check is no longer needed. Remove it together.
The issue is found by sashiko [1].
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the code changes described to the mm/damon/core subsystem in the kernel source: add the walk_control_obsolete field and associated lock-protected logic, update damos_walk() to check the field under walk_control_lock and skip registering requests when obsolete, remove the post-registration context termination check, and initialize/set the field in kdamond_fn() as specified. Rebuild and deploy the updated kernel containing these changes.
Linux kernel mm/damon/core damos_walk()/kdamond_fn() request registration and termination handling = Introduce damon_ctx.walk_control_obsolete protected by damon_ctx->walk_control_lock; have damos_walk() read this field under the lock and avoid registering new requests when obsolete; remove the after-registration DAMON context termination check; initialize (unset) walk_control_obsolete in kdamond_fn() before damon_start() returns and set it just before cancelling remaining damos_walk() requests.