Linux kernel DAMON sysfs: use-after-free reading kdamond state while a context is torn down

Impact

state_show() dereferenced kdamond->damon_ctx without holding damon_sysfs_lock, so a read of the DAMON sysfs state file racing damon_sysfs_turn_damon_on(), kdamond release, or directory removal uses a freed context. DAMON is the kernel's data-access monitor, used on memory-heavy hosts for tiering and working-set analysis, and its sysfs tree is root-owned - so this is a privileged-local race, not a tenant escape, and hosts that never enable DAMON have no exposure at all. Where DAMON is driven by an automation agent that both toggles contexts and polls state, the race is reachable in normal operation and gives kernel memory corruption.

Who can reach it

Local root only: requires write and read access to the DAMON sysfs tree under /sys/kernel/mm/damon, racing a state read against context teardown. Not reachable from an unprivileged container or pod.

What to do

Take the stable kernel fix that acquires damon_sysfs_lock before dereferencing the context (five backports linked) and reboot the node. As an interim measure, stop automation that concurrently toggles kdamond state and reads the state file, or leave DAMON disabled. No fixed version is named in the record.

References

Related entries

• Linux kernel libceph: messenger reads and writes the v1 union member while msgr2 is in use, corrupting connection stateCVE-2025-39880 · Linux kernel libceph messenger (con->v1 union accessed while msgr2 is active)High
• Linux kernel FUSE: slab out-of-bounds write in fuse_dev_do_write when the retrieve length is truncatedCVE-2025-39888 · Linux kernel FUSE (fuse_dev_do_write, folio limit check)High
• Linux kernel i40e: wrong dev_id in free_irq() leaves IRQs un-freed on the MSI-X error pathCVE-2025-39911 · Linux kernel i40e driver (Intel X710/XL710 MSI-X IRQ request error path)High
• Linux kernel BPF: missing destination length check in bpf_crypto_crypt allows out-of-bounds writeCVE-2025-39917 · Linux kernel BPF (bpf_crypto_crypt dynptr length check)High
• Linux kernel io_uring: io_link_skb compares a notification against itself, skipping the context validation checkCVE-2025-39963 · Linux kernel io_uring zero-copy send (io_link_skb notification context check)High
• Linux kernel (net/xfrm): SPI 0 means 'no SPI assigned', but the duplicate-SPI rework started creating states with SPI 0CVE-2025-39965 · Linux kernel (net/xfrm)High