CVE-2026-31652: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31652 Overview

CVE-2026-31652 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Data Access Monitor (DAMON) statistics subsystem. The flaw resides in the mm/damon/stat module, specifically in the damon_stat_start() function. When damon_call() fails, the allocated damon_ctx object is not properly deallocated, creating a memory leak. A naive fix of freeing the context on failure introduces a use-after-free condition because the kdamond main function may still access the object.

The vulnerability affects Linux kernel version 6.17 and 7.0 release candidates rc1 through rc7. Local attackers with low privileges can exploit this flaw to compromise kernel memory integrity.

Critical Impact
Local exploitation can result in kernel memory corruption, potentially leading to privilege escalation, denial of service, or arbitrary code execution in kernel context.

Affected Products

Linux Kernel 6.17
Linux Kernel 7.0-rc1 through 7.0-rc7
Distributions shipping affected mainline kernels with DAMON enabled

Discovery Timeline

2026-04-24 - CVE-2026-31652 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31652

Vulnerability Analysis

The vulnerability exists in the DAMON statistics module within the Linux kernel memory management subsystem. DAMON (Data Access MONitor) is a kernel framework for monitoring data access patterns. The damon_stat_start() function allocates a damon_ctx object named damon_stat_context each time the module is enabled. The function then calls damon_call() to register the context with the DAMON core.

If damon_call() fails, the function returns without freeing the previously allocated damon_ctx. When a user subsequently writes Y to the enabled sysfs interface, damon_stat_start() runs again and overwrites the pointer, leaking the prior allocation. Attempting to free the context immediately after damon_call() failure is unsafe because the kdamond kernel thread may still hold references to the object, leading to a use-after-free condition.

Root Cause

The root cause is improper resource cleanup combined with asynchronous lifetime management between the DAMON context allocation and the kdamond worker thread. The damon_call() failure path does not coordinate with the kdamond termination, leaving the damon_ctx in an ambiguous ownership state. The fix retains the allocation after failure and defers cleanup until the next invocation, returning -EAGAIN if the kdamond thread has not yet terminated.

Attack Vector

Exploitation requires local access with low privileges sufficient to interact with the DAMON sysfs interface. An attacker repeatedly triggers damon_call() failures and toggles the enabled flag to manipulate kernel heap state. Successful exploitation could corrupt adjacent kernel objects or allow access to freed memory regions, depending on heap layout and timing.

No public proof-of-concept code is available. Refer to the upstream commits at kernel.org commit 16c92e9b, commit 447f8870, and commit 4c04c6b4 for the upstream remediation.

Detection Methods for CVE-2026-31652

Indicators of Compromise

Kernel oops or panic messages referencing damon_stat, kdamond, or damon_ctx in dmesg output
Unexpected writes to /sys/kernel/mm/damon/admin/kdamonds/*/enabled from non-administrative processes
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in mm/damon/stat.c
Repeated toggling of the DAMON enabled sysfs attribute within short time windows

Detection Strategies

Audit kernel version inventory to identify hosts running Linux 6.17 or 7.0 release candidates
Enable kernel auditd rules to log access to DAMON sysfs paths and correlate with user identity
Monitor kernel ring buffer for crash signatures involving DAMON functions
Deploy runtime kernel integrity monitoring to flag anomalous kernel memory access patterns

Monitoring Recommendations

Collect dmesg and /var/log/kern.log centrally for analysis of kernel-level anomalies
Track unexpected process termination of user sessions interacting with /sys/kernel/mm/damon/
Alert on kernel panic events on systems that expose DAMON to unprivileged users

How to Mitigate CVE-2026-31652

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisories as soon as distribution updates are available
Restrict access to DAMON sysfs interfaces to root-only by tightening permissions on /sys/kernel/mm/damon/
Identify and prioritize patching of systems running Linux 6.17 or 7.0 release candidates
Disable the DAMON statistics module on systems where it is not required

Patch Information

The vulnerability is resolved in upstream commits 16c92e9bf55fa049ddb5e894dc0623dacd46a620, 447f8870b484f6596d7a7130e72bd0a3f1e037bb, and 4c04c6b47c361612b1d70cec8f7a60b1482d1400. The fix retains the damon_ctx object after damon_call() failure and defers deallocation until the kdamond thread terminates, returning -EAGAIN if it has not.

Workarounds

Unload the DAMON statistics module if not needed: rmmod damon_stat where applicable
Restrict DAMON sysfs write permissions to prevent unprivileged toggling of the enabled flag
Limit local shell access on systems running affected kernel versions until patches are deployed

bash

# Restrict DAMON sysfs access to root only
chmod 600 /sys/kernel/mm/damon/admin/kdamonds/*/enabled
chown root:root /sys/kernel/mm/damon/admin/kdamonds/*/enabled

# Verify current kernel version
uname -r