CVE-2026-31459

Vulnerability

In the Linux kernel's DAMON (Data Access Monitoring) sysfs interface, a memory leak vulnerability exists in the damon_sysfs_commit_input() function. When damon_sysfs_new_test_ctx() fails, the param_ctx variable is not freed because the error path returns early without reaching the cleanup label. This leads to a memory leak [1][2][3].

Exploitation

The vulnerability can be triggered by a privileged user (since sysfs operations require root) by causing an allocation failure in damon_sysfs_new_test_ctx(). This could be achieved by exhausting memory or other resource constraints. The attack surface is local, requiring access to the sysfs interface for DAMON.

Impact

An attacker with sufficient privileges could repeatedly trigger this leak, leading to memory exhaustion and potential denial of service. The CVSS score is 5.5 (Medium), indicating a moderate severity.

Mitigation

The fix is included in the Linux kernel stable updates as commits [1][2][3] (part of a patch series). Users should apply the latest stable kernel updates to remediate this issue.