CVE-2026-31445

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31445", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.090Z", "datePublished": "2026-04-22T13:53:42.090Z", "dateUpdated": "2026-05-11T22:08:50.744Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:08:50.744Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: avoid use of half-online-committed context\n\nOne major usage of damon_call() is online DAMON parameters update. It is\ndone by calling damon_commit_ctx() inside the damon_call() callback\nfunction. damon_commit_ctx() can fail for two reasons: 1) invalid\nparameters and 2) internal memory allocation failures. In case of\nfailures, the damon_ctx that attempted to be updated (commit destination)\ncan be partially updated (or, corrupted from a perspective), and therefore\nshouldn't be used anymore. The function only ensures the damon_ctx object\ncan safely deallocated using damon_destroy_ctx().\n\nThe API callers are, however, calling damon_commit_ctx() only after\nasserting the parameters are valid, to avoid damon_commit_ctx() fails due\nto invalid input parameters. But it can still theoretically fail if the\ninternal memory allocation fails. In the case, DAMON may run with the\npartially updated damon_ctx. This can result in unexpected behaviors\nincluding even NULL pointer dereference in case of damos_commit_dests()\nfailure [1]. Such allocation failure is arguably too small to fail, so\nthe real world impact would be rare. But, given the bad consequence, this\nneeds to be fixed.\n\nAvoid such partially-committed (maybe-corrupted) damon_ctx use by saving\nthe damon_commit_ctx() failure on the damon_ctx object. For this,\nintroduce damon_ctx->maybe_corrupted field. damon_commit_ctx() sets it\nwhen it is failed. kdamond_call() checks if the field is set after each\ndamon_call_control->fn() is executed. If it is set, ignore remaining\ncallback requests and return. All kdamond_call() callers including\nkdamond_fn() also check the maybe_corrupted field right after\nkdamond_call() invocations. If the field is set, break the kdamond_fn()\nmain loop so that DAMON sill doesn't use the context that might be\ncorrupted.\n\n[sj@kernel.org: let kdamond_call() with cancel regardless of maybe_corrupted]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/damon.h", "mm/damon/core.c"], "versions": [{"version": "3301f1861d34f53911a30a8f5f41b9141bd8ed39", "lessThan": "9c495f9d3781cd692bd199531cabd4627155e8cd", "status": "affected", "versionType": "git"}, {"version": "3301f1861d34f53911a30a8f5f41b9141bd8ed39", "lessThan": "1b247cd0654a3a306996fa80741d79296c683a56", "status": "affected", "versionType": "git"}, {"version": "3301f1861d34f53911a30a8f5f41b9141bd8ed39", "lessThan": "26f775a054c3cda86ad465a64141894a90a9e145", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/damon.h", "mm/damon/core.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9c495f9d3781cd692bd199531cabd4627155e8cd"}, {"url": "https://git.kernel.org/stable/c/1b247cd0654a3a306996fa80741d79296c683a56"}, {"url": "https://git.kernel.org/stable/c/26f775a054c3cda86ad465a64141894a90a9e145"}], "title": "mm/damon/core: avoid use of half-online-committed context", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/damon.h", "mm/damon/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9c495f9d3781cd692bd199531cabd4627155e8cd", "status": "affected", "version": "3301f1861d34f53911a30a8f5f41b9141bd8ed39", "versionType": "git"}, {"lessThan": "1b247cd0654a3a306996fa80741d79296c683a56", "status": "affected", "version": "3301f1861d34f53911a30a8f5f41b9141bd8ed39", "versionType": "git"}, {"lessThan": "26f775a054c3cda86ad465a64141894a90a9e145", "status": "affected", "version": "3301f1861d34f53911a30a8f5f41b9141bd8ed39", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/damon.h", "mm/damon/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "54C46FD6-33A9-4762-8D41-DB70D9475EFF", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: avoid use of half-online-committed context\n\nOne major usage of damon_call() is online DAMON parameters update. It is\ndone by calling damon_commit_ctx() inside the damon_call() callback\nfunction. damon_commit_ctx() can fail for two reasons: 1) invalid\nparameters and 2) internal memory allocation failures. In case of\nfailures, the damon_ctx that attempted to be updated (commit destination)\ncan be partially updated (or, corrupted from a perspective), and therefore\nshouldn't be used anymore. The function only ensures the damon_ctx object\ncan safely deallocated using damon_destroy_ctx().\n\nThe API callers are, however, calling damon_commit_ctx() only after\nasserting the parameters are valid, to avoid damon_commit_ctx() fails due\nto invalid input parameters. But it can still theoretically fail if the\ninternal memory allocation fails. In the case, DAMON may run with the\npartially updated damon_ctx. This can result in unexpected behaviors\nincluding even NULL pointer dereference in case of damos_commit_dests()\nfailure [1]. Such allocation failure is arguably too small to fail, so\nthe real world impact would be rare. But, given the bad consequence, this\nneeds to be fixed.\n\nAvoid such partially-committed (maybe-corrupted) damon_ctx use by saving\nthe damon_commit_ctx() failure on the damon_ctx object. For this,\nintroduce damon_ctx->maybe_corrupted field. damon_commit_ctx() sets it\nwhen it is failed. kdamond_call() checks if the field is set after each\ndamon_call_control->fn() is executed. If it is set, ignore remaining\ncallback requests and return. All kdamond_call() callers including\nkdamond_fn() also check the maybe_corrupted field right after\nkdamond_call() invocations. If the field is set, break the kdamond_fn()\nmain loop so that DAMON sill doesn't use the context that might be\ncorrupted.\n\n[sj@kernel.org: let kdamond_call() with cancel regardless of maybe_corrupted]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/core: evitar el uso de contexto medio-online-commitado\n\nUn uso principal de damon_call() es la actualizaci\u00f3n de par\u00e1metros DAMON en l\u00ednea. Se realiza llamando a damon_commit_ctx() dentro de la funci\u00f3n de callback damon_call(). damon_commit_ctx() puede fallar por dos razones: 1) par\u00e1metros inv\u00e1lidos y 2) fallos de asignaci\u00f3n de memoria interna. En caso de fallos, el damon_ctx que intent\u00f3 ser actualizado (destino de commit) puede ser parcialmente actualizado (o, corrompido desde una perspectiva), y por lo tanto no deber\u00eda usarse m\u00e1s. La funci\u00f3n solo asegura que el objeto damon_ctx puede ser desasignado de forma segura usando damon_destroy_ctx().\n\nLos llamadores de la API est\u00e1n, sin embargo, llamando a damon_commit_ctx() solo despu\u00e9s de afirmar que los par\u00e1metros son v\u00e1lidos, para evitar que damon_commit_ctx() falle debido a par\u00e1metros de entrada inv\u00e1lidos. Pero a\u00fan puede fallar te\u00f3ricamente si la asignaci\u00f3n de memoria interna falla. En ese caso, DAMON puede ejecutarse con el damon_ctx parcialmente actualizado. Esto puede resultar en comportamientos inesperados, incluyendo incluso la desreferencia de puntero NULL en caso de fallo de damos_commit_dests() [1]. Tal fallo de asignaci\u00f3n es, discutiblemente, demasiado peque\u00f1o para fallar, por lo que el impacto en el mundo real ser\u00eda raro. Pero, dada la mala consecuencia, esto necesita ser arreglado.\n\nEvitar el uso de dicho damon_ctx parcialmente-commitado (quiz\u00e1s-corrompido) guardando el fallo de damon_commit_ctx() en el objeto damon_ctx. Para esto, se introduce el campo damon_ctx -> maybe_corrupted. damon_commit_ctx() lo establece cuando falla. kdamond_call() verifica si el campo est\u00e1 establecido despu\u00e9s de que se ejecuta cada damon_call_control -> fn(). Si est\u00e1 establecido, ignorar las solicitudes de callback restantes y retornar. Todos los llamadores de kdamond_call(), incluyendo kdamond_fn(), tambi\u00e9n verifican el campo maybe_corrupted justo despu\u00e9s de las invocaciones de kdamond_call(). Si el campo est\u00e1 establecido, romper el bucle principal de kdamond_fn() para que DAMON siga sin usar el contexto que podr\u00eda estar corrompido.\n\n[sj@kernel.org: permitir kdamond_call() con cancelaci\u00f3n independientemente de maybe_corrupted]"}], "id": "CVE-2026-31445", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-22T14:16:38.177", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1b247cd0654a3a306996fa80741d79296c683a56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/26f775a054c3cda86ad465a64141894a90a9e145"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9c495f9d3781cd692bd199531cabd4627155e8cd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm/damon/core: avoid use of half-online-committed context", "id": "2460659", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460659"}, "csaw": false, "cwe": "CWE-372", "details": ["A flaw was found in the Linux kernel. When updating DAMON (Data Access MONitor) parameters, an internal memory allocation failure during the `damon_commit_ctx()` function could leave the DAMON context in a partially corrupted state. If this corrupted context is subsequently used, it can lead to unexpected system behaviors, including a NULL pointer dereference. While the real-world impact is considered rare, this vulnerability could potentially cause system instability."], "name": "CVE-2026-31445", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31445\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31445\nhttps://lore.kernel.org/linux-cve-announce/2026042246-CVE-2026-31445-cbbf@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3301f1861d34f53911a30a8f5f41b9141bd8ed39,9c495f9d3781cd692bd199531cabd4627155e8cd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3301f1861d34f53911a30a8f5f41b9141bd8ed39,1b247cd0654a3a306996fa80741d79296c683a56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3301f1861d34f53911a30a8f5f41b9141bd8ed39,26f775a054c3cda86ad465a64141894a90a9e145)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-22T16:15:21.591098+00:00", "updated": "2026-05-07T21:00:13.398873+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}