CVE-2026-31445

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: avoid use of half-online-committed context

One major usage of damon_call() is online DAMON parameters update. It is

done by calling damon_commit_ctx() inside the damon_call() callback

function. damon_commit_ctx() can fail for two reasons: 1) invalid

parameters and 2) internal memory allocation failures. In case of

failures, the damon_ctx that attempted to be updated (commit destination)

can be partially updated (or, corrupted from a perspective), and therefore

shouldn't be used anymore. The function only ensures the damon_ctx object

can safely deallocated using damon_destroy_ctx().

The API callers are, however, calling damon_commit_ctx() only after

asserting the parameters are valid, to avoid damon_commit_ctx() fails due

to invalid input parameters. But it can still theoretically fail if the

internal memory allocation fails. In the case, DAMON may run with the

partially updated damon_ctx. This

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References