CVE-2026-23012: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23012 Overview

A use-after-free vulnerability has been identified in the Linux kernel's DAMON (Data Access MONitor) subsystem within the memory management component. The vulnerability exists in the mm/damon/core module where improper handling of damon_call_control objects in inactive contexts leads to memory corruption when damon_call() is executed against a DAMON context that is not running.

Critical Impact
This use-after-free vulnerability in the Linux kernel's memory management subsystem can potentially lead to memory corruption and system instability. While exploitation requires sysfs write permissions and specific conditions, successful exploitation could compromise kernel memory integrity.

Affected Products

Linux Kernel (versions with vulnerable DAMON implementation)
Systems utilizing DAMON sysfs interface for memory monitoring
Linux distributions with affected kernel versions

Discovery Timeline

January 25, 2026 - CVE-2026-23012 published to NVD
January 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23012

Vulnerability Analysis

The vulnerability stems from improper lifecycle management of damon_call_control objects within the DAMON subsystem. When damon_call() is executed against a DAMON context that is not actively running, the function returns an error while leaving the damon_call_control object still linked to the context's call_controls list.

This creates a dangerous scenario where the object may be deallocated after the damon_call() returns, but the pointer to it remains in the call_controls list. When a subsequent damon_call() is executed against the same context, the function attempts to add a new damon_call_control object to the list, which still contains a stale pointer to the previously deallocated object. This results in a use-after-free condition.

The vulnerability can be triggered through the DAMON sysfs interface, though exploitation is complicated by the requirement for sysfs write permissions and the need to perform specific file write operations.

Root Cause

The root cause is a synchronization issue in the DAMON context termination logic. The kdamond_call() function for cancelling existing damon_call() requests was being called after the ctx->kdamond pointer was reset. This timing issue meant that code checking for NULL ctx->kdamond could not safely assume that the context had finished accessing damon_call() requests, leading to dangling pointers in the call_controls list.

Attack Vector

The attack vector requires local access with sysfs write permissions. An attacker would need to:

Execute damon_call() against an inactive DAMON context
Trigger deallocation of the damon_call_control object
Execute another damon_call() against the same context to trigger the use-after-free condition

While this requires specific conditions and elevated permissions, the vulnerability demonstrates a kernel memory safety issue that could potentially be chained with other vulnerabilities for privilege escalation.

The vulnerability manifests in the damon_call() function's handling of inactive contexts. When the function encounters an inactive DAMON context, it fails to properly clean up the damon_call_control object from the call_controls list before returning an error. See the kernel git commit for detailed technical analysis.

Detection Methods for CVE-2026-23012

Indicators of Compromise

Unexpected kernel panics or oops messages referencing DAMON or memory management components
System log entries showing memory corruption in mm/damon/core module
Unusual sysfs operations targeting DAMON interfaces
Kernel warning messages related to damon_call() or call_controls list operations

Detection Strategies

Monitor kernel logs for use-after-free warnings in DAMON-related code paths
Deploy kernel memory debugging tools like KASAN (Kernel Address Sanitizer) to detect memory corruption
Audit sysfs access patterns for unusual DAMON interface interactions
Implement system call monitoring for operations targeting /sys/kernel/mm/damon/ paths

Monitoring Recommendations

Enable kernel memory debugging options in non-production environments to detect similar issues
Configure alerting for kernel crash dumps that reference DAMON subsystem components
Review system access logs for users with sysfs write permissions performing unusual operations

How to Mitigate CVE-2026-23012

Immediate Actions Required

Update to a patched Linux kernel version containing the fix commits
Restrict sysfs write permissions to only essential administrative accounts
Audit systems for any signs of exploitation attempts
Consider disabling DAMON functionality if not actively required until patching is complete

Patch Information

The fix implements two key changes to address the vulnerability:

Timing Fix: The final kdamond_call() for cancelling existing damon_call() requests is now executed before the ctx->kdamond pointer is reset, ensuring that code observing NULL ctx->kdamond can safely assume the context will no longer access damon_call() requests
Cleanup Logic: The damon_call() function now properly cleans up damon_call_control objects that were added to already-terminated DAMON contexts before returning an error

Patches are available via the following kernel git commits:

Workarounds

Restrict access to the DAMON sysfs interface by limiting permissions on /sys/kernel/mm/damon/
Disable DAMON functionality at kernel boot using appropriate kernel parameters if the feature is not required
Implement additional access controls for users with sysfs write permissions

bash

# Restrict DAMON sysfs interface permissions
chmod 600 /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/state
# Verify restricted permissions
ls -la /sys/kernel/mm/damon/admin/kdamonds/