CVE-2026-53335

What it actually does

This is a local denial-of-service flaw in the Linux kernel DAMON LRU_SORT feature. When DAMON_LRU_SORT initialization fails to allocate a damon_ctx object, the enable path can still call damon_commit_ctx() with a NULL context pointer. That causes a kernel NULL pointer dereference, which can trigger an oops, panic, or system crash depending on kernel panic settings. The issue does not provide confidentiality or integrity impact by itself; the primary impact is availability loss.

Why it matters to the business

Successful exploitation can crash affected Linux systems or make them unstable, disrupting workloads and services hosted on those systems. Because exploitation requires local access and the EPSS score is very low, broad internet-scale exploitation is unlikely, and it is not currently listed in CISA KEV or associated with ransomware. However, systems that allow local users, containers, automation, or administrators to modify DAMON LRU_SORT settings may face operational risk from accidental or intentional crashes.

How an attack unfolds

An attacker first needs local access to an affected Linux system and the ability to interact with the DAMON LRU_SORT control interface, typically through kernel sysfs/module parameters or equivalent privileged management paths. The attacker then attempts to create conditions where allocation of the DAMON context fails, such as by inducing memory pressure. After that, the attacker enables or toggles DAMON LRU_SORT. On vulnerable kernels, the enable handler assumes the context allocation succeeded and proceeds into damon_commit_ctx() with a NULL ctx pointer. The kernel dereferences the NULL pointer, causing a crash or kernel oops and resulting in denial of service.

How to fix it

Apply a Linux kernel update from the relevant distribution or kernel vendor that includes the fix for DAMON LRU_SORT allocation failure handling, specifically the change that returns -ENOMEM when ctx allocation fails instead of calling damon_commit_ctx() with a NULL pointer. No exact fixed package versions were provided, so rely on vendor advisories and kernel changelogs for the affected distribution. If immediate patching is not possible, mitigate by disabling DAMON_LRU_SORT where it is not required, avoiding loading the damon_lru_sort module, restricting write access to DAMON/sysfs controls to trusted administrators only, and limiting untrusted local shell or container access on systems where the feature is enabled.

How to confirm the fix worked

Confirm the running kernel package includes the upstream/vendor fix for "mm/damon/lru_sort: handle ctx allocation failure". Check the active kernel version with standard OS tooling and compare it against the vendor advisory for this vulnerability. Verify whether the feature is present or enabled by checking kernel configuration and module/sysfs state, including CONFIG_DAMON_LRU_SORT and /sys/module/damon_lru_sort/parameters/enabled if present. After remediation, attempts to enable DAMON_LRU_SORT when context allocation fails should return an allocation error such as -ENOMEM rather than causing a kernel oops or panic. Where feasible, validate in a non-production test system rather than inducing memory pressure on production hosts.

Typical attack path

1. Gain local access to an affected Linux host.
2. Obtain permission or a path to write DAMON LRU_SORT configuration, such as sysfs/module parameter access.
3. Increase memory pressure or otherwise trigger DAMON context allocation failure.
4. Enable or toggle DAMON LRU_SORT.
5. Trigger the NULL pointer dereference in damon_commit_ctx().
6. Cause a kernel oops, panic, reboot, or service outage.

How to detect it

Look for evidence of kernel crashes or oops events around DAMON LRU_SORT activity. Relevant sources include journald, /var/log/kern.log, /var/log/messages, dmesg output, crash dumps, kdump/vmcore artifacts, audit logs for writes to sysfs/module parameters, and endpoint telemetry showing local commands interacting with DAMON controls. Search for NULL pointer dereference messages that include damon_commit_ctx, damon_lru_sort_enabled_store, DAMON_LRU_SORT, kdamond, or damon_lru_sort. Also review auditd or shell history for writes to /sys/module/damon_lru_sort/parameters/enabled shortly before a reboot, kernel panic, or service interruption. Exploitation may leave little persistent evidence beyond kernel logs and crash artifacts because the impact is a crash rather than code execution.

• BUG: kernel NULL pointer dereference
• NULL pointer dereference
• damon_commit_ctx
• damon_lru_sort_enabled_store
• DAMON_LRU_SORT
• damon_lru_sort
• kdamond
• /sys/module/damon_lru_sort/parameters/enabled
• CONFIG_DAMON_LRU_SORT
• mm/damon/lru_sort
• echo 1 > /sys/module/damon_lru_sort/parameters/enabled
• kernel panic
• Oops:

What your security team should do

• Inventory Linux systems running kernels with DAMON_LRU_SORT support and identify where the feature is enabled or exposed.
• Prioritize patching multi-user systems, container hosts, shared compute nodes, and systems where local users or automation can modify kernel/sysfs settings.
• Apply the vendor-provided kernel update and reboot into the fixed kernel.
• If patching is delayed, disable DAMON_LRU_SORT and restrict write access to DAMON-related sysfs/module parameters.
• Monitor kernel logs for NULL pointer dereferences involving DAMON, damon_lru_sort_enabled_store(), or damon_commit_ctx().
• Review local privilege boundaries and ensure untrusted users cannot write to kernel module parameters or DAMON controls.
• Because this is not KEV-listed, has no known mature exploit, and has very low EPSS, handle through normal vulnerability management unless the feature is enabled on sensitive shared systems.