PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43388 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's DAMON (Data Access MONitor) subsystem could allow local attackers to corrupt memory or cause denial of service. The flaw exists in damos_walk() where a stack-allocated walk_control structure pointer is left dangling when the DAMON context is inactive, creating conditions for use-after-free if the context is later started. While the described use-after-free path requires specific caller behavior not present in current code, the stale pointer can cause permanent -EBUSY errors on subsequent damos_walk() calls until the context is restarted. The vulnerability affects Linux kernel versions 6.14 through 6.18.18, 6.19 through 6.19.8, and 7.0-rc1 through 7.0-rc3.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-26
Advisory published
2026-05-08
Advisory updated
2026-05-26

Who should care

Linux kernel maintainers, system administrators running DAMON-enabled kernels, security teams monitoring kernel memory management vulnerabilities, and organizations using DAMON for memory access pattern monitoring in production environments.

Technical summary

The damos_walk() function in mm/damon/core.c sets ctx->walk_control to a caller-provided stack-allocated structure before checking if the DAMON context is running. If damon_is_running() returns false, the function returns -EINVAL without clearing ctx->walk_control, leaving a dangling pointer. Under walk_control_lock, this stale pointer can cause use-after-free if the context is later started (kdamond dereferencing ctx->walk_control in damos_walk_cancel()), or permanent -EBUSY on subsequent damos_walk() calls due to non-NULL check. The fix clears ctx->walk_control before returning -EINVAL, matching the pattern from commit f9132fbc2e83.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches: 6.18.19+, 6.19.9+, or 7.0-rc4+
  • Verify DAMON contexts are properly initialized before damos_walk() calls in custom kernel modules
  • Monitor for unexpected -EBUSY returns from DAMON operations as potential indicator of trigger attempts
  • Restart DAMON contexts if -EBUSY persists on walk operations (workaround until patched)
  • Review custom DAMON callers for patterns that start contexts after failed damos_walk() calls

Evidence notes

The vulnerability description indicates real-world exploitability is constrained: no existing damos_walk() callers start the context after a failed walk, preventing the described use-after-free. The practical impact is limited to -EBUSY confusion until context restart. This structural pattern was previously fixed in commit f9132fbc2e83 for damon_call().

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43388 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43388

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43388 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43388

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9320c77134ab8d7701e20608bbf08517df4fa321

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ce0aa47c963b8c3e5beace89e2b5a665a64b5b6b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d210fdcac9c0d1380eab448aebc93f602c1cd4e6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.