CVE-2026-23012: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23012 is a use-after-free (UAF) vulnerability in the Linux kernel's DAMON (Data Access Monitoring) subsystem, specifically in the mm/damon/core module. When damon_call() is invoked against an inactive DAMON context, it returns an error but leaves the damon_call_control object linked to the context's call_controls list; if that object is subsequently deallocated and damon_call() is called again, the kernel accesses freed memory. Affected versions include Linux kernel 6.17, 6.17.1 through 6.18.6, and 6.19-rc1 through 6.19-rc5. The vulnerability was published on January 25, 2026, with NVD initial analysis completed March 25, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a use-after-free condition (CWE-416) in the damon_call() function within mm/damon/core. When called against a non-running DAMON context, the function fails to remove the damon_call_control object from the context's call_controls linked list before returning an error. If the caller deallocates this object and subsequently invokes damon_call() again on the same context, the kernel attempts to insert a new damon_call_control into a list that still holds a dangling pointer to the freed object, triggering the UAF. The vulnerability is triggerable via the DAMON sysfs interface (e.g., /sys/kernel/mm/damon/) by a local user with sysfs write permissions performing an unusual sequence of file writes. The fix involves two changes: moving kdamond_call() cancellation before the ctx->kdamond reset, and ensuring damon_call() cleans up damon_call_control objects added to already-terminated contexts before returning (Red Hat Bugzilla, kernel.org patch 1, kernel.org patch 2).

Successful exploitation can lead to memory corruption, enabling a local attacker with sysfs write permissions to achieve privilege escalation, information disclosure, or arbitrary code execution within the kernel context. The vulnerability affects confidentiality, integrity, and availability at a high level, as corrupted kernel memory can be leveraged to read sensitive kernel data, modify kernel structures, or crash the system. While exploitation requires local access and specific sysfs write permissions, a compromised low-privileged user account on an affected system could potentially escalate to root (Red Hat Advisory).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for local access and sysfs write permissions, as well as the need to perform a specific, non-obvious sequence of file writes to the DAMON sysfs interface, making opportunistic exploitation unlikely. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term (Red Hat Advisory).

1. Gain local access: Obtain a local user account on a vulnerable Linux system (kernel 6.17–6.18.6 or 6.19-rc1 through 6.19-rc5) with write permissions to the DAMON sysfs interface (e.g., /sys/kernel/mm/damon/).
2. Initialize a DAMON context: Write to the appropriate DAMON sysfs files to create and configure a DAMON monitoring context without starting the kdamond thread, leaving the context in an inactive state.
3. Trigger the first damon_call(): Perform a sysfs write operation that internally invokes damon_call() against the inactive context, causing it to return an error while leaving the damon_call_control object linked in the call_controls list.
4. Deallocate the control object: Allow or trigger the deallocation of the damon_call_control object (e.g., by completing the sysfs operation that allocated it), leaving a dangling pointer in the list.
5. Trigger the second damon_call(): Perform another sysfs write that invokes damon_call() on the same context, causing the kernel to access the freed memory and triggering the use-after-free condition.
6. Exploit memory corruption: Leverage the UAF to achieve kernel memory read/write primitives, potentially enabling privilege escalation to root or arbitrary code execution in kernel space (Red Hat Bugzilla).

• Logs: Kernel oops or BUG messages in dmesg or /var/log/kern.log referencing mm/damon/core.c or damon_call; KASAN (Kernel Address Sanitizer) reports indicating use-after-free in DAMON-related functions.
• File System / sysfs: Unusual or repeated writes to DAMON sysfs paths such as /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/operations or related control files by non-root users.
• Process: Unexpected privilege escalation events from processes interacting with DAMON sysfs; processes with low privileges accessing /sys/kernel/mm/damon/ in an anomalous pattern.

Update the Linux kernel to version 6.18.7 or later (stable branch), or 6.19-rc6 or later (development branch). Patches have been committed to the stable kernel tree at commits 23b061f421eef03647b512f3df48861706c87db3 (for the 6.18.x branch) and f9132fbc2e83baf2c45a77043672a63a675c9394 (kernel.org patch 1, kernel.org patch 2). As a workaround for systems that cannot be immediately patched, restrict sysfs write permissions on DAMON-related paths (e.g., /sys/kernel/mm/damon/) to trusted administrative users only, and monitor for unusual access patterns to these interfaces (Red Hat Advisory).

The vulnerability received standard tracking from Red Hat's Product Security team via Bugzilla, with an upstream kernel advisory referenced at the linux-cve-announce mailing list. No notable independent researcher commentary, media coverage, or significant social media discussion beyond automated CVE tracking posts has been identified for this vulnerability.