CVE-2026-31458

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31458", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.092Z", "datePublished": "2026-04-22T13:53:50.883Z", "dateUpdated": "2026-11-05T21:44:59.942Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:09:07.003Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]\n\nMultiple sysfs command paths dereference contexts_arr[0] without first\nverifying that kdamond->contexts->nr == 1. A user can set nr_contexts to\n0 via sysfs while DAMON is running, causing NULL pointer dereferences.\n\nIn more detail, the issue can be triggered by privileged users like\nbelow.\n\nFirst, start DAMON and make contexts directory empty\n(kdamond->contexts->nr == 0).\n\n # damo start\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 > contexts/nr_contexts\n\nThen, each of below commands will cause the NULL pointer dereference.\n\n # echo update_schemes_stats > state\n # echo update_schemes_tried_regions > state\n # echo update_schemes_tried_bytes > state\n # echo update_schemes_effective_quotas > state\n # echo update_tuned_intervals > state\n\nGuard all commands (except OFF) at the entry point of\ndamon_sysfs_handle_cmd()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/damon/sysfs.c"], "versions": [{"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "aba546061341b56e9ffb37e1eb661a3628b6ec12", "status": "affected", "versionType": "git"}, {"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "1e8da792672481d603fa7cd0d815577220a3ee27", "status": "affected", "versionType": "git"}, {"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "708033c231bd782858f4ddbb46ee874a5a5fbdab", "status": "affected", "versionType": "git"}, {"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "bbe03ad3fb9e714191757ca7b41582f930be7be2", "status": "affected", "versionType": "git"}, {"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "1bfe9fb5ed2667fb075682408b776b5273162615", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/damon/sysfs.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.131"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aba546061341b56e9ffb37e1eb661a3628b6ec12"}, {"url": "https://git.kernel.org/stable/c/1e8da792672481d603fa7cd0d815577220a3ee27"}, {"url": "https://git.kernel.org/stable/c/708033c231bd782858f4ddbb46ee874a5a5fbdab"}, {"url": "https://git.kernel.org/stable/c/bbe03ad3fb9e714191757ca7b41582f930be7be2"}, {"url": "https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"}], "title": "mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31458", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:34:11.121096Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:44:59.942Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31458", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:34:11.121096Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:34:12.253Z"}}], "cna": {"title": "mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "aba546061341b56e9ffb37e1eb661a3628b6ec12", "versionType": "git"}, {"status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "1e8da792672481d603fa7cd0d815577220a3ee27", "versionType": "git"}, {"status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "708033c231bd782858f4ddbb46ee874a5a5fbdab", "versionType": "git"}, {"status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "bbe03ad3fb9e714191757ca7b41582f930be7be2", "versionType": "git"}, {"status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "lessThan": "1bfe9fb5ed2667fb075682408b776b5273162615", "versionType": "git"}], "programFiles": ["mm/damon/sysfs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.131", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/damon/sysfs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/aba546061341b56e9ffb37e1eb661a3628b6ec12"}, {"url": "https://git.kernel.org/stable/c/1e8da792672481d603fa7cd0d815577220a3ee27"}, {"url": "https://git.kernel.org/stable/c/708033c231bd782858f4ddbb46ee874a5a5fbdab"}, {"url": "https://git.kernel.org/stable/c/bbe03ad3fb9e714191757ca7b41582f930be7be2"}, {"url": "https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]\n\nMultiple sysfs command paths dereference contexts_arr[0] without first\nverifying that kdamond->contexts->nr == 1. A user can set nr_contexts to\n0 via sysfs while DAMON is running, causing NULL pointer dereferences.\n\nIn more detail, the issue can be triggered by privileged users like\nbelow.\n\nFirst, start DAMON and make contexts directory empty\n(kdamond->contexts->nr == 0).\n\n # damo start\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 > contexts/nr_contexts\n\nThen, each of below commands will cause the NULL pointer dereference.\n\n # echo update_schemes_stats > state\n # echo update_schemes_tried_regions > state\n # echo update_schemes_tried_bytes > state\n # echo update_schemes_effective_quotas > state\n # echo update_tuned_intervals > state\n\nGuard all commands (except OFF) at the entry point of\ndamon_sysfs_handle_cmd()."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.131", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "5.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:09:07.003Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31458", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:44:59.942Z", "dateReserved": "2026-03-09T15:48:24.092Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:53:50.883Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/damon/sysfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "aba546061341b56e9ffb37e1eb661a3628b6ec12", "status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "versionType": "git"}, {"lessThan": "1e8da792672481d603fa7cd0d815577220a3ee27", "status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "versionType": "git"}, {"lessThan": "708033c231bd782858f4ddbb46ee874a5a5fbdab", "status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "versionType": "git"}, {"lessThan": "bbe03ad3fb9e714191757ca7b41582f930be7be2", "status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "versionType": "git"}, {"lessThan": "1bfe9fb5ed2667fb075682408b776b5273162615", "status": "affected", "version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/damon/sysfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.131", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D97A2DBE-7050-465E-8B7D-E7D3C8122FA9", "versionEndExcluding": "6.6.131", "versionStartIncluding": "5.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]\n\nMultiple sysfs command paths dereference contexts_arr[0] without first\nverifying that kdamond->contexts->nr == 1. A user can set nr_contexts to\n0 via sysfs while DAMON is running, causing NULL pointer dereferences.\n\nIn more detail, the issue can be triggered by privileged users like\nbelow.\n\nFirst, start DAMON and make contexts directory empty\n(kdamond->contexts->nr == 0).\n\n # damo start\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 > contexts/nr_contexts\n\nThen, each of below commands will cause the NULL pointer dereference.\n\n # echo update_schemes_stats > state\n # echo update_schemes_tried_regions > state\n # echo update_schemes_tried_bytes > state\n # echo update_schemes_effective_quotas > state\n # echo update_tuned_intervals > state\n\nGuard all commands (except OFF) at the entry point of\ndamon_sysfs_handle_cmd()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/sysfs: verificar contexts -> nr antes de acceder a contexts_arr[0]\n\nM\u00faltiples rutas de comandos sysfs desreferencian contexts_arr[0] sin verificar primero que kdamond -> contexts -> nr == 1. Un usuario puede establecer nr_contexts en 0 a trav\u00e9s de sysfs mientras DAMON est\u00e1 en ejecuci\u00f3n, causando desreferencias de puntero NULL.\n\nEn m\u00e1s detalle, el problema puede ser activado por usuarios privilegiados como se muestra a continuaci\u00f3n.\n\nPrimero, inicie DAMON y deje el directorio contexts vac\u00edo (kdamond -> contexts -> nr == 0).\n\n # damo start\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 > contexts/nr_contexts\n\nLuego, cada uno de los siguientes comandos causar\u00e1 la desreferencia del puntero NULL.\n\n # echo update_schemes_stats > state\n # echo update_schemes_tried_regions > state\n # echo update_schemes_tried_bytes > state\n # echo update_schemes_effective_quotas > state\n # echo update_tuned_intervals > state\n\nProteja todos los comandos (excepto OFF) en el punto de entrada de damon_sysfs_handle_cmd()."}], "id": "CVE-2026-31458", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31458", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:34:11.121096Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:41.260", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1e8da792672481d603fa7cd0d815577220a3ee27"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/708033c231bd782858f4ddbb46ee874a5a5fbdab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aba546061341b56e9ffb37e1eb661a3628b6ec12"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bbe03ad3fb9e714191757ca7b41582f930be7be2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]", "id": "2460725", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460725"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1284", "details": ["A flaw was found in the Linux kernel. A privileged local user can exploit this by manipulating the `nr_contexts` parameter in the `mm/damon/sysfs` interface to zero while the DAMON (Data Access MONitor) subsystem is active. This leads to a null pointer dereference when certain sysfs commands are subsequently executed, potentially causing a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-31458", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31458\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31458\nhttps://lore.kernel.org/linux-cve-announce/2026042250-CVE-2026-31458-5a8e@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ac32b8affb5a384253dbb8339bd2d0e91add0b7,aba546061341b56e9ffb37e1eb661a3628b6ec12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ac32b8affb5a384253dbb8339bd2d0e91add0b7,1e8da792672481d603fa7cd0d815577220a3ee27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ac32b8affb5a384253dbb8339bd2d0e91add0b7,708033c231bd782858f4ddbb46ee874a5a5fbdab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ac32b8affb5a384253dbb8339bd2d0e91add0b7,bbe03ad3fb9e714191757ca7b41582f930be7be2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ac32b8affb5a384253dbb8339bd2d0e91add0b7,1bfe9fb5ed2667fb075682408b776b5273162615)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.131,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.80,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T15:45:01.877297+00:00", "value": {"mitigation_remediation": ["Apply the kernel patch that corrects the null\u2011pointer dereference in the DAMON sysfs handler", "Upgrade to the latest kernel release that contains the fix", "If the patch cannot be applied immediately, disable the DAMON module or restrict write access to /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts"], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via NULL pointer dereference in the Linux DAMON sysfs interface"}, "threat_synthesis": {"affected_systems": "All Linux kernel versions that include the DAMON (Designation of Areas for Monitoring On-demand) module are potentially affected; the specific patch was applied to the kernel code without enumerating affected releases, so users should verify their kernel version against the latest available release that incorporates the fix.", "description_and_impact": "A bug in the Linux kernel DAMON subsystem allows a privileged user to dereference a null pointer when manipulating context objects through sysfs, causing a kernel crash. The flaw arises because the code does not verify that the number of contexts equals one before accessing the first context array element. The resulting crash can interrupt services running on the affected machine, leading to service outages and potential loss of availability. The likely attack vector is local privileged users with write access to the /sys filesystem.", "risk_and_exploitability": "The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, and the CVSS score is 5.5. A user with root or equivalent privilege can trigger the flaw by writing 0 to the \"nr_contexts\" attribute in the DAMON sysfs hierarchy and then issuing any of the state commands that exercise the uninitialized context. Because the kernel ultimately crashes, the exploit leads to a denial of service. The risk remains high for systems that enable and expose DAMON to privileged users."}}}}, "created": "2026-04-22T17:15:21.908909+00:00", "updated": "2026-04-28T15:45:06.387174+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-1284", "CWE-476"]}