{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23012", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.940Z", "datePublished": "2026-01-25T14:36:25.187Z", "dateUpdated": "2026-05-11T21:58:17.877Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:58:17.877Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: remove call_control in inactive contexts\n\nIf damon_call() is executed against a DAMON context that is not running,\nthe function returns error while keeping the damon_call_control object\nlinked to the context's call_controls list. Let's suppose the object is\ndeallocated after the damon_call(), and yet another damon_call() is\nexecuted against the same context. The function tries to add the new\ndamon_call_control object to the call_controls list, which still has the\npointer to the previous damon_call_control object, which is deallocated. \nAs a result, use-after-free happens.\n\nThis can actually be triggered using the DAMON sysfs interface. It is not\neasily exploitable since it requires the sysfs write permission and making\na definitely weird file writes, though. Please refer to the report for\nmore details about the issue reproduction steps.\n\nFix the issue by making two changes. Firstly, move the final\nkdamond_call() for cancelling all existing damon_call() requests from\nterminating DAMON context to be done before the ctx->kdamond reset. This\nmakes any code that sees NULL ctx->kdamond can safely assume the context\nmay not access damon_call() requests anymore. Secondly, let damon_call()\nto cleanup the damon_call_control objects that were added to the\nalready-terminated DAMON context, before returning the error."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/damon/core.c"], "versions": [{"version": "004ded6bee11b8ed463cdc54b89a4390f4b64f6d", "lessThan": "23b061f421eef03647b512f3df48861706c87db3", "status": "affected", "versionType": "git"}, {"version": "004ded6bee11b8ed463cdc54b89a4390f4b64f6d", "lessThan": "f9132fbc2e83baf2c45a77043672a63a675c9394", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/damon/core.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.7", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/23b061f421eef03647b512f3df48861706c87db3"}, {"url": "https://git.kernel.org/stable/c/f9132fbc2e83baf2c45a77043672a63a675c9394"}], "title": "mm/damon/core: remove call_control in inactive contexts", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/damon/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "23b061f421eef03647b512f3df48861706c87db3", "status": "affected", "version": "004ded6bee11b8ed463cdc54b89a4390f4b64f6d", "versionType": "git"}, {"lessThan": "f9132fbc2e83baf2c45a77043672a63a675c9394", "status": "affected", "version": "004ded6bee11b8ed463cdc54b89a4390f4b64f6d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/damon/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDCC46B4-613C-4010-9820-E91FA006C1F2", "versionEndExcluding": "6.18.7", "versionStartIncluding": "6.17.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*", "matchCriteriaId": "7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: remove call_control in inactive contexts\n\nIf damon_call() is executed against a DAMON context that is not running,\nthe function returns error while keeping the damon_call_control object\nlinked to the context's call_controls list. Let's suppose the object is\ndeallocated after the damon_call(), and yet another damon_call() is\nexecuted against the same context. The function tries to add the new\ndamon_call_control object to the call_controls list, which still has the\npointer to the previous damon_call_control object, which is deallocated. \nAs a result, use-after-free happens.\n\nThis can actually be triggered using the DAMON sysfs interface. It is not\neasily exploitable since it requires the sysfs write permission and making\na definitely weird file writes, though. Please refer to the report for\nmore details about the issue reproduction steps.\n\nFix the issue by making two changes. Firstly, move the final\nkdamond_call() for cancelling all existing damon_call() requests from\nterminating DAMON context to be done before the ctx->kdamond reset. This\nmakes any code that sees NULL ctx->kdamond can safely assume the context\nmay not access damon_call() requests anymore. Secondly, let damon_call()\nto cleanup the damon_call_control objects that were added to the\nalready-terminated DAMON context, before returning the error."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/core: eliminar call_control en contextos inactivos\n\nSi damon_call() se ejecuta contra un contexto DAMON que no est\u00e1 en ejecuci\u00f3n, la funci\u00f3n devuelve un error mientras mantiene el objeto damon_call_control vinculado a la lista call_controls del contexto. Supongamos que el objeto es desasignado despu\u00e9s de damon_call(), y se ejecuta otro damon_call() contra el mismo contexto. La funci\u00f3n intenta a\u00f1adir el nuevo objeto damon_call_control a la lista call_controls, que todav\u00eda tiene el puntero al objeto damon_call_control anterior, que est\u00e1 desasignado. Como resultado, ocurre un uso despu\u00e9s de liberaci\u00f3n.\n\nEsto puede ser realmente activado usando la interfaz sysfs de DAMON. Sin embargo, no es f\u00e1cilmente explotable ya que requiere el permiso de escritura de sysfs y realizar escrituras de archivo definitivamente extra\u00f1as. Por favor, consulte el informe para m\u00e1s detalles sobre los pasos de reproducci\u00f3n del problema.\n\nSolucione el problema realizando dos cambios. En primer lugar, mueva la kdamond_call() final para cancelar todas las solicitudes damon_call() existentes del contexto DAMON que termina, para que se realice antes del reinicio de ctx->kdamond. Esto hace que cualquier c\u00f3digo que vea NULL en ctx->kdamond pueda asumir con seguridad que el contexto ya no puede acceder a las solicitudes damon_call(). En segundo lugar, permita que damon_call() limpie los objetos damon_call_control que fueron a\u00f1adidos al contexto DAMON ya terminado, antes de devolver el error."}], "id": "CVE-2026-23012", "lastModified": "2026-06-17T10:20:42.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-01-25T15:15:56.073", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/23b061f421eef03647b512f3df48861706c87db3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f9132fbc2e83baf2c45a77043672a63a675c9394"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm/damon/core: remove call_control in inactive contexts", "id": "2432660", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432660"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2026-23012", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23012\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23012\nhttps://lore.kernel.org/linux-cve-announce/2026012538-CVE-2026-23012-8a3d@gregkh/T"]}

{"analysis": {"en": {"generated_at": "2026-04-18T02:49:43.854571+00:00", "value": {"mitigation_remediation": ["Upgrade to a Linux kernel version that includes the DAMON call_control cleanup fix, such as kernel\u202f6.19 or later, to eliminate the use\u2011after\u2011free vulnerability.", "If an upgrade is not immediately possible, restrict or disable write access to the DAMON sysfs interface so that only privileged users can invoke damon_call(), reducing the window for exploitation.", "Audit sysfs permissions regularly and monitor for anomalous damon_call attempts; consider disabling the DAMON feature on systems that do not require it."], "summary": {"action": "Apply Patch", "impact": "Use-after-free (memory corruption)"}, "threat_synthesis": {"affected_systems": "The flaw affects the Linux kernel, specifically versions where the DAMON subsystem had not incorporated the fix\u2014this includes kernel 6.17 and all 6.19 release\u2011candidate releases from rc1 through rc8. Systems running those kernels with the DAMON sysfs interface enabled are vulnerable. The impacted product line is Linux:Linux, as listed by the CNA, with CPE references covering linux_kernel 6.17 and 6.19 rc1\u2013rc8.", "description_and_impact": "In the DAMON subsystem of the Linux kernel, executing damon_call() against a context that has ceased operation leaves a dangling call_control pointer in the context\u2019s call_controls list. Subsequent invocations of damon_call() reuse this stale pointer, resulting in a use\u2011after\u2011free that can corrupt kernel memory. The primary effect is memory corruption that, if an attacker can trigger it, may allow them to crash the kernel or potentially gain arbitrary code execution, depending on the surrounding memory state. This is a classic use\u2011after\u2011free weakness (CWE\u2011416).", "risk_and_exploitability": "The advisory lists a CVSS base score of 7.8, indicating high severity, while the EPSS score is under 1\u202f%, suggesting a low probability that the flaw has already been exploited. The vulnerability is not present in CISA's KEV catalog. Exploitation requires write access to the DAMON sysfs interface and the ability to perform a specific, non\u2011trivial sequence of file writes; it is not trivially exploitable by ordinary unprivileged users. Consequently, the overall risk is moderate, rising only if sysfs write permissions are broadly available or if the attacker can achieve elevated privileges to manipulate the DAMON interface."}}}}, "created": "2026-04-18T03:00:10.325693+00:00", "updated": "2026-04-18T03:00:10.325706+00:00", "vendors": []}