Cloudanix VulnDB

CVE-2026-31458

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Apr 22, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's memory monitoring tool can let a logged-in administrator accidentally or deliberately crash the entire machine.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

NULL pointer dereference in damon_sysfs_handle_cmd when kdamond contexts nr is set to 0, triggered by specific sysfs state commands on a running DAMON instance.

Why it matters to the business

Local privileged users can crash affected Linux systems, causing denial of service and potential loss of monitoring or workload stability on servers and embedded devices running the kernel.

How an attack unfolds

An attacker with local privileges starts DAMON, empties its contexts via sysfs to set nr to zero, then issues one of the update_schemes_* or update_tuned_intervals commands to trigger the dereference and kernel panic.

How to fix it

Update the Linux kernel to a version containing the guard in damon_sysfs_handle_cmd that rejects commands when nr_contexts is zero; apply the upstream patch if a fixed release is unavailable for the distribution.

How to confirm the fix worked

Verify the running kernel contains the context count check before dereferencing contexts_arr; confirm DAMON sysfs paths reject the listed commands when nr_contexts is zero without oops.

Typical attack path

  1. Obtain local shell with privileges to write DAMON sysfs files
  2. Start a DAMON instance and set contexts/nr_contexts to 0
  3. Write one of the triggering strings to the state sysfs file
  4. Observe kernel NULL dereference and system instability

How to detect it

Inspect kernel logs for NULL pointer dereference oops originating from damon_sysfs_handle_cmd after sysfs writes to DAMON state or nr_contexts files.

  • damo start followed by echo 0 > contexts/nr_contexts
  • echo update_schemes_stats > state
  • kernel NULL pointer dereference in damon_sysfs

What your security team should do

  • Prioritize kernel updates on all systems exposing DAMON sysfs
  • Restrict write access to /sys/kernel/mm/damon to the minimum required users
  • Monitor for kernel oops involving damon_sysfs in production workloads
  • Disable DAMON if the feature is unused to reduce attack surface

The record

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Multiple sysfs command paths dereference contexts_arr[0] without first verifying that kdamond->contexts->nr == 1. A user can set nr_contexts to 0 via sysfs while DAMON is running, causing NULL pointer dereferences. In more detail, the issue can be triggered by privileged users like below. First, start DAMON and make contexts directory empty (kdamond->contexts->nr == 0). # damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/nr_contexts Then, each of below commands will cause the NULL pointer dereference. # echo update_schemes_stats > state # echo update_schemes_tried_regions > state # echo update_schemes_tried_bytes > state # echo update_schemes_effective_quotas > state # echo update_tuned_intervals > state Guard all commands (except OFF) at the entry point of damon_sysfs_handle_cmd().

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities