Linux Kernel CVE-2026-31458

The vulnerability requires five specific conditions: (1) DAMON must be compiled into the kernel (CONFIG_DAMON_SYSFS=y) and active, (2) the attacker must have local system access with CAP_SYS_ADMIN or equivalent capability to write to /sys/kernel/mm/damon/admin sysfs files, (3) a kdamond instance must be running (e.g., via 'damo start'), (4) the nr_contexts value for the kdamond must be set to exactly zero (vulnerability does not trigger if contexts exist or if DAMON is not running), and (5) the attacker must explicitly issue one of the affected state commands (update_schemes_stats, update_schemes_tried_regions, update_schemes_tried_bytes, update_schemes_effective_quotas, or update_tuned_intervals). Default Linux deployments without DAMON enabled or with properly restricted sysfs permissions are not vulnerable. The vulnerability does not affect unauthenticated remote users or unprivileged local users without CAP_SYS_ADMIN.

The risk assessment presents a clear disconnect between CVSS and real-world exploitability. CVSS 5.5 with AV:L/AC:L/PR:L indicates local, low-complexity exploitation by a low-privileged user, normally a moderate concern. However, EPSS 0.02% (5th percentile) and the detailed technical requirements substantially lower practical risk. The vulnerability requires: (1) local system access, (2) CAP_SYS_ADMIN or equivalent privilege to modify sysfs DAMON settings, (3) an active DAMON instance, and (4) explicit multi-step user action (start DAMON, set contexts to zero, issue specific state commands). The attack yields only denial of service (crash/hang), not privilege escalation or data exfiltration. No KEV listing and no public exploit code reported. This is a low-priority vulnerability suitable for standard maintenance patching rather than emergency response. Organizations should prioritize patching systems where unprivileged users might have DAMON sysfs write access or where local denial of service is a critical threat; most deployments lack DAMON enabled or restrict sysfs appropriately.

A local user with CAP_SYS_ADMIN privilege (e.g., a container admin or system administrator) starts a DAMON instance via damo start, then echoes 0 to /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts to empty the contexts array. Next, the user echoes 'update_schemes_stats' or another affected command to the state file, causing the kernel to dereference a NULL pointer in the DAMON handler, triggering a kernel oops and denial of service. This requires multiple deliberate actions rather than a single malicious input, limiting accidental triggering.