CVE-2026-31653: Linux Kernel Memory Leak Vulnerability

CVE-2026-31653 Overview

CVE-2026-31653 is a memory leak vulnerability in the Linux kernel's DAMON (Data Access MONitor) subsystem, specifically within the sysfs interface implementation. The vulnerability occurs when the damon_call() function fails to properly deallocate the dynamically allocated repeat_call_control structure under certain error conditions.

The flaw manifests when monitoring virtual address processes through DAMON, where if the monitored process terminates before the damon_call() invocation completes, the kdamond thread may be stopped prematurely. In this scenario, the dynamically allocated repeat_call_control memory is never freed, resulting in a kernel memory leak.

Critical Impact
This vulnerability can lead to kernel memory exhaustion through repeated memory leaks, potentially causing system instability or denial of service conditions on affected Linux systems.

Affected Products

Linux Kernel versions 6.14 through 6.15.2
Linux Kernel version 6.17
Linux Kernel version 7.0-rc1 through 7.0-rc7

Discovery Timeline

April 24, 2026 - CVE CVE-2026-31653 published to NVD
April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31653

Vulnerability Analysis

This memory leak vulnerability exists in the DAMON sysfs interface within the Linux kernel's memory management subsystem. DAMON is a data access monitoring framework that provides mechanisms for monitoring data access patterns of running processes.

The vulnerability arises from a missing cleanup path when damon_call() fails for repeat_call_control operations initiated via DAMON_SYSFS. When the kdamond kernel thread is stopped before the damon_call() function can complete—which can occur when a monitored virtual address process terminates unexpectedly—the previously allocated repeat_call_control structure is not properly deallocated.

The impact of this vulnerability is a denial of service condition through memory exhaustion. Local attackers with low privileges can potentially trigger this condition repeatedly by creating and rapidly terminating processes that are being monitored through the DAMON sysfs interface.

Root Cause

The root cause is the absence of proper error handling and memory deallocation when damon_call() fails. The code path for the repeat_call_control structure allocation does not include a corresponding deallocation routine when the kdamond thread stops unexpectedly before the call completes. This is a classic resource management oversight where the failure path does not clean up dynamically allocated resources.

Attack Vector

This vulnerability requires local access to the system with low privileges. An attacker must be able to interact with the DAMON sysfs interface to initiate monitoring of virtual address processes. The attack scenario involves:

Creating a process that will be monitored by DAMON
Initiating DAMON monitoring through the sysfs interface
Terminating the monitored process immediately before damon_call() completes
Repeating this process to accumulate leaked memory, eventually exhausting system resources

The fix addresses this by ensuring proper deallocation of the repeat_call_control structure when damon_call() returns a failure status.

Detection Methods for CVE-2026-31653

Indicators of Compromise

Unusual kernel memory growth in the kmalloc-* slab caches related to DAMON operations
System memory pressure or out-of-memory (OOM) conditions without corresponding userspace memory usage
Increased /proc/slabinfo entries showing unaccounted allocations in memory management structures

Detection Strategies

Monitor kernel memory usage trends using tools like slabtop or /proc/meminfo for unexplained growth
Implement kernel memory leak detection using kmemleak debugging facility when investigating suspected exploitation
Review system logs for OOM killer activity that cannot be attributed to userspace processes

Monitoring Recommendations

Enable kernel memory debugging options such as CONFIG_DEBUG_KMEMLEAK in test environments
Monitor /sys/kernel/mm/damon/ sysfs interface access patterns for unusual activity
Set up alerting for systems experiencing gradual memory pressure without clear userspace causes

How to Mitigate CVE-2026-31653

Immediate Actions Required

Update affected Linux kernel installations to patched versions as soon as possible
Review and restrict access to the DAMON sysfs interface (/sys/kernel/mm/damon/) to trusted users only
Monitor systems for signs of memory exhaustion while awaiting patch deployment

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures proper deallocation of the repeat_call_control structure when damon_call() fails. The patches are available through the following kernel git commits:

Workarounds

Disable DAMON functionality if not required by removing or blacklisting the DAMON kernel modules
Restrict sysfs access permissions to the /sys/kernel/mm/damon/ directory to root only
Implement namespace isolation for untrusted processes to limit their access to DAMON interfaces

bash

# Restrict DAMON sysfs interface access to root only
chmod 700 /sys/kernel/mm/damon/

# Optional: Disable DAMON if not needed (requires reboot with kernel parameter)
# Add to kernel command line: damon=off