CVE-2026-31653: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31653 is a memory leak vulnerability in the Linux kernel's DAMON (Data Access MONitoring) sysfs interface, specifically in the mm/damon/sysfs subsystem. When the kdamond kernel daemon stops before damon_call() executes — for example, when a monitored virtual address process terminates immediately — the dynamically allocated repeat_call_control structure is not deallocated, resulting in a kernel memory leak. The vulnerability was discovered by researcher "sashiko" and disclosed on April 24, 2026. It affects Linux kernel versions 6.17.1 through 6.18.22 and 6.19 through 6.19.12, as well as pre-release 7.0 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime) — a memory leak in the DAMON sysfs interface's handling of repeat_call_control. The race condition occurs when a DAMON context is configured to monitor a virtual address space process, and that process terminates before damon_call() is invoked; the kdamond thread stops, causing damon_call() to return a failure code, but the error path does not free the previously allocated repeat_call_control structure. Exploitation requires local access with low privileges (e.g., a user-space process that can interact with the DAMON sysfs interface and trigger process termination). The fix, applied in patch commits 0199390a, 0655f5cf, and b9dadf02, adds deallocation of repeat_call_control in the damon_call() failure path (GitHub Advisory, Red Hat Bugzilla).

Successful repeated exploitation causes incremental kernel memory exhaustion, as each leaked repeat_call_control allocation is never freed. Over time, this degrades system performance, increases memory pressure, and can ultimately result in a denial of service when kernel memory is exhausted. There is no confidentiality or integrity impact; the vulnerability is limited to availability (A:H in CVSS terms), and exploitation is constrained to local, low-privileged attackers with no lateral movement potential (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of exploitation in the near term. Triggering the leak requires local access and the ability to create DAMON monitoring contexts targeting processes that terminate rapidly (GitHub Advisory).

Upgrade the Linux kernel to a patched version: 6.18.23 or later for the 6.18.x branch, 6.19.13 or later for the 6.19.x branch, or 7.0 (stable release) or later. Patch commits are 0199390a6b92fc21860e1b858abf525c7e73b956, 0655f5cf1735508394ef8af98ddcfab3ac1c1cc5, and b9dadf026a9fb681ed32a0646adc10ab485bf3b1. As a short-term workaround on systems where patching is not immediately possible, restricting unprivileged access to the DAMON sysfs interface (e.g., via appropriate file permissions or disabling DAMON if not required) can reduce exposure (GitHub Advisory, Red Hat Bugzilla).

Red Hat opened a security tracking bug (Bugzilla #2461564) on the day of disclosure and referenced the upstream kernel CVE announcement mailing list (lore.kernel.org/linux-cve-announce). No significant public researcher commentary or media coverage beyond standard vulnerability tracking has been observed, consistent with the moderate severity and limited exploitability of this issue (Red Hat Bugzilla).