CVE-2026-31652

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/stat: deallocate damon_call() failure leaking damon_ctx

damon_stat_start() always allocates the module's damon_ctx object

(damon_stat_context). Meanwhile, if damon_call() in the function fails,

the damon_ctx object is not deallocated. Hence, if the damon_call() is

failed, and the user writes Y to “enabled” again, the previously

allocated damon_ctx object is leaked.

This cannot simply be fixed by deallocating the damon_ctx object when

damon_call() fails. That's because damon_call() failure doesn't guarantee

the kdamond main function, which accesses the damon_ctx object, is

completely finished. In other words, if damon_stat_start() deallocates

the damon_ctx object after damon_call() failure, the not-yet-terminated

kdamond could access the freed memory (use-after-free).

Fix the leak while avoiding the use-after-free by keeping returning

damon_stat_start() without deallocating the damon_ctx object after

da

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References