CVE-2026-31459: Linux Kernel Information Disclosure Flaw

CVE-2026-31459 Overview

CVE-2026-31459 is a memory leak vulnerability [CWE-401] in the Linux kernel's Data Access MONitor (DAMON) sysfs interface. The flaw exists in the damon_sysfs_commit_input() function within the mm/damon/sysfs subsystem. When damon_sysfs_new_test_ctx() fails during context allocation, the param_ctx structure is leaked because the early return path bypasses cleanup at the out label. The vulnerability requires local access with low privileges and can be triggered by a privileged user issuing incorrect control sequences. The issue is part of a broader patch series addressing memory leak and NULL pointer dereference issues in DAMON_SYSFS.

Critical Impact
Local low-privileged users can trigger kernel memory leaks through repeated allocation failures, leading to resource exhaustion and potential denial of service on affected systems.

Affected Products

Linux Kernel version 6.17.6
Linux Kernel 6.18 (including release candidates rc3 through rc7)
Linux Kernel 7.0 (release candidates rc1 through rc5)

Discovery Timeline

2026-04-22 - CVE-2026-31459 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31459

Vulnerability Analysis

The vulnerability resides in the DAMON sysfs interface, which exposes kernel memory access monitoring controls to userspace. DAMON is a Linux kernel subsystem that monitors data access patterns to inform memory management decisions. The damon_sysfs_commit_input() function processes user-supplied configuration by creating a parameter context via damon_sysfs_new_test_ctx(). When this allocation fails, the function returns early without destroying the previously allocated param_ctx structure. This results in kernel memory being permanently leaked on each failure path invocation. Repeated triggering of the failure condition by a privileged local user can exhaust kernel memory resources, degrading system stability and availability.

Root Cause

The root cause is improper error path handling in damon_sysfs_commit_input(). The function uses a goto-based cleanup pattern with an out label, but the early return on damon_sysfs_new_test_ctx() failure bypasses this cleanup logic. The param_ctx allocation persists in memory with no remaining reference, creating a classic memory leak pattern categorized under CWE-401 (Missing Release of Memory after Effective Lifetime).

Attack Vector

Exploitation requires local access to the system with low-privilege credentials sufficient to interact with the DAMON sysfs interface. An attacker repeatedly submits malformed or resource-exhausting DAMON configuration sequences through sysfs to trigger the allocation failure path. Each failed attempt leaks kernel memory. The attack does not require user interaction and impacts system availability without affecting confidentiality or integrity.

No public proof-of-concept code is available. The fix is documented in kernel commits 7fe000eb32904758a85e62f6ea9483f89d5dabfc, e9de9f3ce06b133a348006668bc8d25c6e504867, and f76f0a964bc3d7b7e253b43c669c41356bc54e71. See the Linux kernel stable tree commits for the patch implementation details.

Detection Methods for CVE-2026-31459

Indicators of Compromise

Steadily increasing kernel slab memory usage observable via /proc/slabinfo without corresponding workload increases
Unusual write activity to /sys/kernel/mm/damon/ sysfs entries from non-administrative processes
Kernel kmalloc allocations associated with DAMON context structures growing without release
System availability degradation or out-of-memory conditions on hosts with active DAMON sysfs usage

Detection Strategies

Monitor kernel memory consumption trends using slabtop and compare against baseline measurements
Audit processes accessing /sys/kernel/mm/damon/admin/ interfaces and correlate with privilege levels
Deploy auditd rules on the DAMON sysfs path to log write operations and identify anomalous control sequences
Track kernel ring buffer messages for repeated allocation failures associated with DAMON subsystem

Monitoring Recommendations

Establish baseline metrics for kernel slab cache size on systems with DAMON enabled
Configure alerts for sustained growth in kernel memory consumption exceeding normal operational thresholds
Log all sysfs interactions with the DAMON subsystem for forensic review
Review kernel version inventory to identify hosts running vulnerable 6.17.6, 6.18, and 7.0 release candidate builds

How to Mitigate CVE-2026-31459

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 7fe000eb3290, e9de9f3ce06b, and f76f0a964bc3 from the Linux stable tree
Update affected systems to a patched Linux kernel release once distributions publish backported fixes
Restrict access to DAMON sysfs interfaces to trusted administrative accounts only
Audit which local users hold privileges sufficient to write to /sys/kernel/mm/damon/

Patch Information

The Linux kernel maintainers resolved this vulnerability through three commits in the stable tree. The fix destroys param_ctx before returning when damon_sysfs_new_test_ctx() fails, ensuring proper cleanup on the error path. Patch references are available at the Linux kernel git stable repository, with additional commits at e9de9f3c and f76f0a96.

Workarounds

Disable DAMON sysfs support by setting CONFIG_DAMON_SYSFS=n and rebuilding the kernel where operationally feasible
Apply restrictive Linux file permissions on the /sys/kernel/mm/damon/ directory to limit interactive access
Use Linux Security Modules such as SELinux or AppArmor policies to restrict DAMON sysfs writes to authorized contexts
Monitor and alert on memory pressure indicators to detect ongoing exploitation attempts pending patch deployment

bash

# Configuration example: restrict access to DAMON sysfs interface
chmod 700 /sys/kernel/mm/damon/admin/
chown root:root /sys/kernel/mm/damon/admin/

# Verify kernel version against affected releases
uname -r