SB2026042565 - Memory leak in Linux kernel damon

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-31652)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in damon_stat_start() when handling repeated writes to the "enabled" control after damon_call() failure. A local user can write Y to the "enabled" interface again after a failed damon_call() to cause a denial of service.

The issue occurs because the previously allocated damon_ctx object remains allocated after the failure condition.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/16c92e9bf55fa049ddb5e894dc0623dacd46a620
• https://git.kernel.org/stable/c/447f8870b484f6596d7a7130e72bd0a3f1e037bb
• https://git.kernel.org/stable/c/4c04c6b47c361612b1d70cec8f7a60b1482d1400