CVE-2026-31653

Vulnerability

Description

In the Linux kernel's DAMON sysfs interface, a memory leak exists when the damon_call() function fails for a dynamically allocated repeat_call_control structure. The failure can happen if the kdamond is stopped before the damon_call() invocation, for example, when the monitored process terminates immediately [1]. Under such conditions, the allocated memory is not freed, causing a leak.

Exploitation

Scenario

An attacker with the ability to trigger the creation and immediate termination of memory-monitoring contexts (e.g., via specific process lifecycle operations) can cause repeated allocations of repeat_call_control that are never deallocated. This does not require special privileges beyond those needed to set up DAMON monitoring, which may be available to unprivileged users depending on system configuration.

Impact

The primary impact is a memory leak that, if repeatedly triggered, could exhaust system memory and lead to denial of service. The leak does not directly allow code execution or privilege escalation.

Mitigation

The fix was applied in the Linux kernel stable tree [1]. Users should update to a kernel version containing the commit that deallocates repeat_call_control when damon_call() fails. There are no known workarounds other than applying the patch.