CVE-2026-23012

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: remove call_control in inactive contexts

If damon_call() is executed against a DAMON context that is not running,

the function returns error while keeping the damon_call_control object

linked to the context's call_controls list. Let's suppose the object is

deallocated after the damon_call(), and yet another damon_call() is

executed against the same context. The function tries to add the new

damon_call_control object to the call_controls list, which still has the

pointer to the previous damon_call_control object, which is deallocated.

As a result, use-after-free happens.

This can actually be triggered using the DAMON sysfs interface. It is not

easily exploitable since it requires the sysfs write permission and making

a definitely weird file writes, though. Please refer to the report for

more details about the issue reproduction steps.

Fix the issue by making two changes. Firstly, move the final

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References