CVE-2026-53335: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53335 Overview

CVE-2026-53335 is a NULL pointer dereference vulnerability in the Linux kernel's Data Access Monitor (DAMON) subsystem, specifically in the mm/damon/lru_sort module. The flaw exists in damon_lru_sort_enabled_store(), which assumes that allocation of the damon_ctx object always succeeds. When allocation fails, execution continues into damon_commit_ctx() with a NULL ctx pointer, causing a kernel dereference of NULL memory. The upstream fix returns -ENOMEM when ctx is NULL, preventing the invalid dereference.

Critical Impact
A local attacker able to trigger memory allocation failure while toggling DAMON_LRU_SORT can crash the kernel, resulting in denial of service on the affected system.

Affected Products

Linux kernel versions containing the mm/damon/lru_sort module prior to the fix
Distributions shipping affected upstream kernels with DAMON_LRU_SORT enabled
Systems where the DAMON subsystem is compiled into the kernel or loaded as a module

Discovery Timeline

2026-07-01 - CVE-2026-53335 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-53335

Vulnerability Analysis

DAMON (Data Access MONitor) is a Linux kernel subsystem for monitoring data access patterns. The DAMON_LRU_SORT module reorders LRU lists based on observed access patterns to improve memory reclaim efficiency. The module allocates a damon_ctx object for its kdamond kernel thread during initialization.

The defect resides in damon_lru_sort_enabled_store(), which handles writes to the sysfs interface controlling whether LRU sorting is enabled. The function proceeds under the assumption that the damon_ctx allocation performed at init time always succeeds. When allocation actually fails, ctx remains NULL, but the code path still invokes damon_commit_ctx() on the NULL pointer, producing a kernel NULL pointer dereference [CWE-476].

Root Cause

The root cause is missing error handling for a failed kernel memory allocation. The init function does not propagate the allocation failure into a state that damon_lru_sort_enabled_store() can check, and the store function does not validate ctx before dereferencing it.

Attack Vector

Exploitation requires local access to the system and the ability to write to the DAMON_LRU_SORT sysfs interface, typically restricted to privileged users. An attacker who can induce memory pressure sufficient to cause damon_ctx allocation failure, then toggle the enabled attribute, triggers the NULL dereference and a resulting kernel oops. The primary security consequence is denial of service rather than code execution or privilege escalation.

No verified public exploit code is available. See the upstream fix commits 6d48f15, ab04340, and daab199 for the exact source changes.

Detection Methods for CVE-2026-53335

Indicators of Compromise

Kernel oops or panic messages referencing damon_commit_ctx or damon_lru_sort_enabled_store in dmesg and /var/log/kern.log.
Unexpected system reboots or hangs correlated with writes to DAMON sysfs attributes under /sys/module/damon_lru_sort/parameters/.
Memory pressure events immediately preceding DAMON-related kernel faults.

Detection Strategies

Inventory running kernels to identify hosts on versions prior to the commits 6d48f15, ab04340, and daab199 where DAMON_LRU_SORT is present.
Audit access to DAMON sysfs interfaces to detect unusual write activity from non-administrative processes.
Correlate out-of-memory conditions with subsequent kernel warnings involving the DAMON subsystem.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on BUG: unable to handle or Oops entries mentioning damon.
Monitor process activity that writes to /sys/module/damon_lru_sort/parameters/enabled.
Track kernel version drift across the Linux fleet to ensure patched builds are deployed consistently.

How to Mitigate CVE-2026-53335

Immediate Actions Required

Apply the upstream kernel patches from commits 6d48f15, ab04340, and daab199 or install a distribution kernel that includes the fix.
Restrict write access to DAMON sysfs interfaces to trusted administrative users only.
Prioritize patching on multi-tenant hosts where local users could induce allocation failures.

Patch Information

The fix adds a NULL check in damon_lru_sort_enabled_store() and returns -ENOMEM when ctx is NULL, avoiding the invalid dereference. Patches are available in the mainline and stable kernel trees via the commits 6d48f15, ab04340, and daab199.

Workarounds

Disable the DAMON_LRU_SORT module where it is not required, either at build time or by preventing it from loading at runtime.
Tighten file permissions and Mandatory Access Control policies on DAMON sysfs attributes to limit exposure to local, unprivileged workloads.
Reduce memory pressure risk by ensuring adequate memory headroom and enabling appropriate OOM controls on affected hosts.

bash

# Verify whether DAMON_LRU_SORT is present and check kernel version
uname -r
grep DAMON /boot/config-$(uname -r)
ls /sys/module/damon_lru_sort/parameters/ 2>/dev/null

# Restrict access to the DAMON sysfs enable attribute
chmod 600 /sys/module/damon_lru_sort/parameters/enabled