GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46008 (GCVE-0-2026-46008)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:56 – Updated: 2026-06-14 17:47
VLAI
Title
mm/damon/core: fix damos_walk() vs kdamond_fn() exit race
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race When kdamond_fn() main loop is finished, the function cancels remaining damos_walk() request and unset the damon_ctx->kdamond so that API callers and API functions themselves can show the context is terminated. damos_walk() adds the caller's request to the queue first. After that, it shows if the kdamond of the damon_ctx is still running (damon_ctx->kdamond is set). Only if the kdamond is running, damos_walk() starts waiting for the kdamond's handling of the newly added request. The damos_walk() requests registration and damon_ctx->kdamond unset are protected by different mutexes, though. Hence, damos_walk() could race with damon_ctx->kdamond unset, and result in deadlocks. For example, let's suppose kdamond successfully finished the damow_walk() request cancelling. Right after that, damos_walk() is called for the context. It registers the new request, and shows the context is still running, because damon_ctx->kdamond unset is not yet done. Hence the damos_walk() caller starts waiting for the handling of the request. However, the kdamond is already on the termination steps, so it never handles the new request. As a result, the damos_walk() caller thread infinitely waits. Fix this by introducing another damon_ctx field, namely walk_control_obsolete. It is protected by the damon_ctx->walk_control_lock, which protects damos_walk() request registration. Initialize (unset) it in kdamond_fn() before letting damon_start() returns and set it just before the cancelling of the remaining damos_walk() request is executed. damos_walk() reads the obsolete field under the lock and avoids adding a new request. After this change, only requests that are guaranteed to be handled or cancelled are registered. Hence the after-registration DAMON context termination check is no longer needed. Remove it together. The issue is found by sashiko [1].
Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 , < 0ba956a239ba6e3fae8555d3660e22e675be63b5 (git)
Affected: bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 , < 33c3f6c2b48cd84b441dba1ee3e62290e53930f4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 7.0.4 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/damon.h",
            "mm/damon/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ba956a239ba6e3fae8555d3660e22e675be63b5",
              "status": "affected",
              "version": "bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61",
              "versionType": "git"
            },
            {
              "lessThan": "33c3f6c2b48cd84b441dba1ee3e62290e53930f4",
              "status": "affected",
              "version": "bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/damon.h",
            "mm/damon/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: fix damos_walk() vs kdamond_fn() exit race\n\nWhen kdamond_fn() main loop is finished, the function cancels remaining\ndamos_walk() request and unset the damon_ctx-\u003ekdamond so that API callers\nand API functions themselves can show the context is terminated. \ndamos_walk() adds the caller\u0027s request to the queue first.  After that, it\nshows if the kdamond of the damon_ctx is still running (damon_ctx-\u003ekdamond\nis set).  Only if the kdamond is running, damos_walk() starts waiting for\nthe kdamond\u0027s handling of the newly added request.\n\nThe damos_walk() requests registration and damon_ctx-\u003ekdamond unset are\nprotected by different mutexes, though.  Hence, damos_walk() could race\nwith damon_ctx-\u003ekdamond unset, and result in deadlocks.\n\nFor example, let\u0027s suppose kdamond successfully finished the damow_walk()\nrequest cancelling.  Right after that, damos_walk() is called for the\ncontext.  It registers the new request, and shows the context is still\nrunning, because damon_ctx-\u003ekdamond unset is not yet done.  Hence the\ndamos_walk() caller starts waiting for the handling of the request. \nHowever, the kdamond is already on the termination steps, so it never\nhandles the new request.  As a result, the damos_walk() caller thread\ninfinitely waits.\n\nFix this by introducing another damon_ctx field, namely\nwalk_control_obsolete.  It is protected by the\ndamon_ctx-\u003ewalk_control_lock, which protects damos_walk() request\nregistration.  Initialize (unset) it in kdamond_fn() before letting\ndamon_start() returns and set it just before the cancelling of the\nremaining damos_walk() request is executed.  damos_walk() reads the\nobsolete field under the lock and avoids adding a new request.\n\nAfter this change, only requests that are guaranteed to be handled or\ncancelled are registered.  Hence the after-registration DAMON context\ntermination check is no longer needed.  Remove it together.\n\nThe issue is found by sashiko [1]."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:47:40.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ba956a239ba6e3fae8555d3660e22e675be63b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/33c3f6c2b48cd84b441dba1ee3e62290e53930f4"
        }
      ],
      "title": "mm/damon/core: fix damos_walk() vs kdamond_fn() exit race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46008",
    "datePublished": "2026-05-27T12:56:08.315Z",
    "dateReserved": "2026-05-13T15:03:33.092Z",
    "dateUpdated": "2026-06-14T17:47:40.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46008",
      "date": "2026-09-16",
      "epss": "0.00079",
      "percentile": "0.00168"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46008\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:18.600\",\"lastModified\":\"2026-06-17T10:52:53.427\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/damon/core: fix damos_walk() vs kdamond_fn() exit race\\n\\nWhen kdamond_fn() main loop is finished, the function cancels remaining\\ndamos_walk() request and unset the damon_ctx-\u003ekdamond so that API callers\\nand API functions themselves can show the context is terminated. \\ndamos_walk() adds the caller\u0027s request to the queue first.  After that, it\\nshows if the kdamond of the damon_ctx is still running (damon_ctx-\u003ekdamond\\nis set).  Only if the kdamond is running, damos_walk() starts waiting for\\nthe kdamond\u0027s handling of the newly added request.\\n\\nThe damos_walk() requests registration and damon_ctx-\u003ekdamond unset are\\nprotected by different mutexes, though.  Hence, damos_walk() could race\\nwith damon_ctx-\u003ekdamond unset, and result in deadlocks.\\n\\nFor example, let\u0027s suppose kdamond successfully finished the damow_walk()\\nrequest cancelling.  Right after that, damos_walk() is called for the\\ncontext.  It registers the new request, and shows the context is still\\nrunning, because damon_ctx-\u003ekdamond unset is not yet done.  Hence the\\ndamos_walk() caller starts waiting for the handling of the request. \\nHowever, the kdamond is already on the termination steps, so it never\\nhandles the new request.  As a result, the damos_walk() caller thread\\ninfinitely waits.\\n\\nFix this by introducing another damon_ctx field, namely\\nwalk_control_obsolete.  It is protected by the\\ndamon_ctx-\u003ewalk_control_lock, which protects damos_walk() request\\nregistration.  Initialize (unset) it in kdamond_fn() before letting\\ndamon_start() returns and set it just before the cancelling of the\\nremaining damos_walk() request is executed.  damos_walk() reads the\\nobsolete field under the lock and avoids adding a new request.\\n\\nAfter this change, only requests that are guaranteed to be handled or\\ncancelled are registered.  Hence the after-registration DAMON context\\ntermination check is no longer needed.  Remove it together.\\n\\nThe issue is found by sashiko [1].\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/damon.h\",\"mm/damon/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61\",\"lessThan\":\"0ba956a239ba6e3fae8555d3660e22e675be63b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61\",\"lessThan\":\"33c3f6c2b48cd84b441dba1ee3e62290e53930f4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/damon.h\",\"mm/damon/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.4\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"7.0.4\",\"matchCriteriaId\":\"241B688D-8E14-4010-AB9E-D5F5E52FA273\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ba956a239ba6e3fae8555d3660e22e675be63b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/33c3f6c2b48cd84b441dba1ee3e62290e53930f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:40:29+00:00",
      "cve": "CVE-2026-46008",
      "id": "CVE-2026-46008",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46008.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T16:57:36Z",
      "cve": "CVE-2026-46008",
      "id": "CVE-2026-46008",
      "initial_release_date": "2026-05-28T03:54:29Z",
      "product_status:known_not_affected": "299",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46008",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46008.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.