CVE-2026-46008: Linux Kernel Race Condition Vulnerability

CVE-2026-46008 Overview

CVE-2026-46008 is a race condition in the Linux kernel's Data Access MONitor (DAMON) subsystem, specifically within mm/damon/core. The flaw exists between the damos_walk() API caller path and the kdamond_fn() main loop exit path. Because request registration and the damon_ctx->kdamond unset operation are protected by different mutexes, a caller can register a walk request after the kdamond thread has already cancelled outstanding requests but before the context is marked terminated. The thread then waits indefinitely for a handler that will never run, producing a deadlock. The issue was identified using the sashiko fuzzing tool.

Critical Impact
Local processes invoking DAMON damos_walk() operations during kdamond termination can hang indefinitely, leading to denial of service in the affected kernel subsystem.

Affected Products

Linux kernel (mainline) memory management subsystem — mm/damon/core
Linux kernel stable branches receiving the referenced commits
Systems with DAMON enabled and userspace consumers of the damos_walk() interface

Discovery Timeline

2026-05-27 - CVE-2026-46008 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46008

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the DAMON core. The damos_walk() function queues a caller request, then checks whether damon_ctx->kdamond is still set to decide whether to wait for the kdamond worker to service that request. When the kdamond worker exits, kdamond_fn() cancels any remaining damos_walk() requests and then clears damon_ctx->kdamond.

The two operations are guarded by separate mutexes. As a result, the walk request can be registered after the cancellation step has already completed but before the kdamond pointer is cleared. The caller observes the context as still running and begins waiting on a worker that is already shutting down. The worker never processes the newly queued request, leaving the caller blocked.

Root Cause

The root cause is inconsistent locking around two state transitions that must be observed atomically by damos_walk(). Request registration is protected by damon_ctx->walk_control_lock, while damon_ctx->kdamond clearing is protected by a different mutex. This split allows a registration to slip in after the worker stops accepting work but before the visibility flag changes.

The upstream fix introduces a new walk_control_obsolete field guarded by walk_control_lock. kdamond_fn() sets the field before cancelling outstanding requests, and damos_walk() checks it under the same lock before queuing. Only requests guaranteed to be serviced or cancelled are accepted, and the post-registration termination check is removed.

Attack Vector

Exploitation requires local access to a process able to invoke DAMON damos_walk() operations on a context whose kdamond worker is concurrently terminating. The vulnerability manifests as an indefinite wait in the calling thread rather than memory corruption. The race window is narrow but reachable through repeated start/stop cycles on a DAMON context, as demonstrated by the sashiko fuzzer that reported the issue. See the upstream commits 0ba956a239ba and 33c3f6c2b48c for the patch details.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-46008

Indicators of Compromise

Processes stuck in uninterruptible or interruptible sleep inside DAMON damos_walk() call paths, visible in /proc/<pid>/stack.
Kernel hung task warnings referencing damos_walk, kdamond_fn, or walk_control symbols.
DAMON contexts that fail to terminate cleanly after a stop request, leaving orphaned waiters.

Detection Strategies

Audit running kernel versions against the fixed commits 0ba956a239ba and 33c3f6c2b48c to identify hosts still exposed.
Enable CONFIG_DETECT_HUNG_TASK and review dmesg for hung task tracebacks involving the DAMON subsystem.
Correlate workloads that exercise DAMON tuning interfaces with reports of stalled monitoring or telemetry agents.

Monitoring Recommendations

Track kernel dmesg for INFO: task ... blocked for more than messages and forward them to a centralized log pipeline.
Monitor DAMON sysfs interfaces under /sys/kernel/mm/damon/ for contexts whose state does not transition out of on after stop commands.
Alert on long-lived threads in DAMON-related stack frames using periodic stack sampling on critical hosts.

How to Mitigate CVE-2026-46008

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 0ba956a239ba and 33c3f6c2b48c once they land in your distribution's stable kernel.
Restrict access to DAMON sysfs and debugfs interfaces to privileged administrators only.
Avoid scripted rapid start/stop cycles against DAMON contexts on unpatched kernels.

Patch Information

The fix is applied in the Linux kernel mm/damon/core source by introducing the walk_control_obsolete field protected by damon_ctx->walk_control_lock. The commits are available at kernel.org commit 0ba956a239ba and kernel.org commit 33c3f6c2b48c. Rebuild and deploy a kernel that includes both commits, or install the corresponding vendor-provided update.

Workarounds

Disable DAMON by building or booting a kernel without CONFIG_DAMON where the feature is not required.
Remove or tighten permissions on the DAMON sysfs tree to prevent untrusted local users from triggering damos_walk() races.
Where DAMON must remain enabled, avoid concurrent administrative operations that simultaneously stop a context and issue walk requests.

bash

# Verify whether the running kernel contains the fix commits
uname -r
git -C /usr/src/linux log --oneline | grep -E '0ba956a239ba|33c3f6c2b48c'

# Restrict DAMON sysfs access to root only
chmod -R o-rwx /sys/kernel/mm/damon/ 2>/dev/null || true