CVE-2026-43388: In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: clear walk_control on inactive context in damos_walk() damos_walk() sets…

PriorityP340high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.12%

2.5th percentile

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: clear walk_control on inactive context in damos_walk() damos_walk() sets ctx->walk_control to the caller-provided control structure before checking whether the context is running. If the context is inactive (damon_is_running() returns false), the function returns -EINVAL without clearing ctx->walk_control. This leaves a dangling pointer to a stack-allocated structure that will be freed when the caller returns. This is structurally identical to the bug fixed in commit f9132fbc2e83 ("mm/damon/core: remove call_control in inactive contexts") for damon_call(), which had the same pattern of linking a control object and returning an error without unlinking it. The dangling walk_control pointer can cause: 1. Use-after-free if the context is later started and kdamond dereferences ctx->walk_control (e.g., in damos_walk_cancel() which writes to control->canceled and calls complete()) 2. Permanent -EBUSY from subsequent damos_walk() calls, since the stale pointer is non-NULL Nonetheless, the real user impact is quite restrictive. The use-after-free is impossible because there is no damos_walk() callers who starts the context later. The permanent -EBUSY can actually confuse users, as DAMON is not running. But the symptom is kept only while the context is turned off. Turning it on again will make DAMON internally uses a newly generated damon_ctx object that doesn't have the invalid damos_walk_control pointer, so everything will work fine again. Fix this by clearing ctx->walk_control under walk_control_lock before returning -EINVAL, mirroring the fix pattern from f9132fbc2e83.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
linux	linux	—	—
linux	linux	>= bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 < ce0aa47c963b8c3e5beace89e2b5a665a64b5b6b	ce0aa47c963b8c3e5beace89e2b5a665a64b5b6b
linux	linux	>= bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 < 9320c77134ab8d7701e20608bbf08517df4fa321	9320c77134ab8d7701e20608bbf08517df4fa321
linux	linux	>= bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 < d210fdcac9c0d1380eab448aebc93f602c1cd4e6	d210fdcac9c0d1380eab448aebc93f602c1cd4e6
linux	linux_kernel	—	—
linux	linux_kernel	>= 6.14 < 6.18.19	6.18.19
linux	linux_kernel	>= 6.19 < 6.19.9	6.19.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.