CVE-2026-31652

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/stat: deallocate damoncall() failure leaking damonctx

damonstatstart() always allocates the module's damonctx object (damonstatcontext). Meanwhile, if damoncall() in the function fails, the damonctx object is not deallocated. Hence, if the damoncall() is failed, and the user writes Y to “enabled” again, the previously allocated damon_ctx object is leaked.

This cannot simply be fixed by deallocating the damonctx object when damoncall() fails. That's because damoncall() failure doesn't guarantee the kdamond main function, which accesses the damonctx object, is completely finished. In other words, if damonstatstart() deallocates the damonctx object after damoncall() failure, the not-yet-terminated kdamond could access the freed memory (use-after-free).

Fix the leak while avoiding the use-after-free by keeping returning damonstatstart() without deallocating the damonctx object after damoncall() failure, but deallocating it when the function is invoked again and the kdamond is completely terminated. If the kdamond is not yet terminated, simply return -EAGAIN, as the kdamond will soon be terminated.

The issue was discovered [1] by sashiko.