CVE-2026-31652: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31652 is a memory leak and use-after-free vulnerability in the Linux kernel's DAMON (Data Access Monitoring) statistics module (mm/damon/stat). The damon_stat_start() function allocates a damon_ctx object (damon_stat_context) but fails to deallocate it when damon_call() returns an error, leading to progressive kernel memory exhaustion if a user repeatedly writes to the enabled sysfs attribute. Affected versions include Linux kernel 6.17, 6.17.1 through 6.18.22, 6.19 through 6.19.12, and 7.0 release candidates (rc1–rc7). The vulnerability was disclosed on April 24, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-416 (Use After Free). In damon_stat_start(), a damon_ctx object is always allocated, but if the subsequent damon_call() fails, the object is not freed — because doing so immediately could cause a use-after-free if the kdamond kernel thread (which accesses the damon_ctx) has not yet fully terminated. The fix defers deallocation to the next invocation of damon_stat_start(), at which point it checks whether kdamond has fully terminated before freeing the previously leaked object; if not yet terminated, it returns -EAGAIN. The attack vector is local, requires only low privileges (write access to the DAMON sysfs enabled attribute), and no user interaction (GitHub Advisory, Red Hat Bugzilla).

A local attacker with low privileges can repeatedly trigger damon_call() failures by writing to the DAMON statistics sysfs enabled attribute, causing progressive kernel memory exhaustion that can lead to denial of service. In a worst-case scenario, a race condition between deallocation and the still-running kdamond thread could result in a use-after-free condition, potentially enabling memory corruption with high confidentiality, integrity, and availability impact on the affected system (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory).

1. Gain local access: Obtain a local shell on a system running an affected Linux kernel version (6.17–6.18.22, 6.19–6.19.12, or 7.0-rc1 through rc7) with at least low-privilege user access.
2. Locate the DAMON sysfs interface: Identify the DAMON statistics sysfs path, typically under /sys/kernel/mm/damon/ or a similar sysfs mount point where the enabled attribute is exposed.
3. Trigger damon_call() failure: Write Y to the enabled sysfs attribute in a manner that causes damon_call() to fail (e.g., under resource pressure or specific timing conditions), resulting in a damon_ctx object being allocated but not freed.
4. Repeat to exhaust memory: Repeatedly write to the enabled attribute after each failure to progressively leak additional damon_ctx objects, accumulating unreleased kernel memory allocations.
5. Achieve denial of service: Continue until kernel memory is sufficiently exhausted to cause system instability or a crash, achieving a denial-of-service condition (GitHub Advisory).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing repeated errors or warnings from the mm/damon/stat subsystem; unusual -EAGAIN return codes from DAMON-related calls.
• System Behavior: Progressive increase in kernel memory usage (observable via /proc/meminfo — decreasing MemFree/MemAvailable) without a corresponding increase in user-space process memory; system slowdown or OOM (Out-of-Memory) killer events.
• File System / sysfs: Unusual or repeated writes to DAMON sysfs attributes (e.g., /sys/kernel/mm/damon/*/enabled) by non-root low-privilege users, detectable via auditd rules on sysfs write events.
• Process: Presence of kdamond threads in unexpected states (e.g., lingering zombie-like states) visible via ps aux | grep kdamond or /proc/*/status.

Patches are available in Linux kernel versions 6.18.23, 6.19.13, and the 7.0 final release. Stable kernel commits addressing this issue are available at git.kernel.org (commits 16c92e9b, 447f8870, and 4c04c6b4). As a temporary workaround, administrators can restrict write access to the DAMON statistics sysfs attributes (e.g., via file permissions or SELinux/AppArmor policies) to prevent low-privilege users from triggering the vulnerable code path, though upgrading to a patched kernel version is strongly recommended (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was discovered by a researcher identified as "sashiko" and reported through standard Linux kernel security channels. Red Hat opened a security tracking bug (Bugzilla #2461492) shortly after disclosure, and the upstream kernel advisory was published via the linux-cve-announce mailing list. No significant broader media coverage or notable public researcher commentary beyond standard vulnerability tracking has been observed (Red Hat Bugzilla).