PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31457 Linux CVE debrief

A vulnerability was found in the Linux kernel, specifically in the DAMON (Data Access Monitoring) subsystem. The issue arises from a missing check for the 'nr' field in the 'contexts' structure, which can lead to a NULL pointer dereference when certain functions are called. This vulnerability can be exploited by setting 'nr_contexts' to 0 via sysfs while DAMON is running, causing the functions to dereference 'contexts_arr[0]' and resulting in a NULL pointer dereference.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-06-05
Advisory published
2026-04-22
Advisory updated
2026-06-05

Who should care

Users of the Linux kernel, particularly those using versions 6.17, 6.19, and 7.0 RC versions, should be aware of this vulnerability. The vulnerability can be mitigated by applying the provided patches.

Technical summary

The vulnerability is caused by a missing check for 'contexts->nr' in the 'damon_sysfs_repeat_call_fn' function. This function calls other functions without checking if 'nr_contexts' is set to 0, which can lead to a NULL pointer dereference. The affected functions are 'damon_sysfs_upd_tuned_intervals', 'damon_sysfs_upd_schemes_stats', and 'damon_sysfs_upd_schemes_effective_quotas'.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply the provided patches to fix the vulnerability.
  • Monitor and update Linux kernel versions to ensure the latest security patches are applied.

Evidence notes

The vulnerability was resolved by adding a check for 'contexts->nr' in the affected functions. Patches are available for Linux kernel versions 6.17, 6.19, and 7.0 RC versions.

Official resources

CVE-2026-31457 was published on 2026-04-22T14:16:41.133Z and modified on 2026-06-05T17:38:29.660Z.