{"id":"CVE-2026-46008","revision":"3679fe2712a945c59e5543dafcc89bef","records":[{"revision":"3679fe2712a945c59e5543dafcc89bef","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-46008","aliases":[],"title":"mm/damon/core: fix damos_walk() vs kdamond_fn() exit race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: fix damos_walk() vs kdamond_fn() exit race\n\nWhen kdamond_fn() main loop is finished, the function cancels remaining\ndamos_walk() request and unset the damon_ctx->kdamond so that API callers\nand API functions themselves can show the context is terminated. \ndamos_walk() adds the caller's request to the queue first.  After that, it\nshows if the kdamond of the damon_ctx is still running (damon_ctx->kdamond\nis set).  Only if the kdamond is running, damos_walk() starts waiting for\nthe kdamond's handling of the newly added request.\n\nThe damos_walk() requests registration and damon_ctx->kdamond unset are\nprotected by different mutexes, though.  Hence, damos_walk() could race\nwith damon_ctx->kdamond unset, and result in deadlocks.\n\nFor example, let's suppose kdamond successfully finished the damow_walk()\nrequest cancelling.  Right after that, damos_walk() is called for the\ncontext.  It registers the new request, and shows the context is still\nrunning, because damon_ctx->kdamond unset is not yet done.  Hence the\ndamos_walk() caller starts waiting for the handling of the request. \nHowever, the kdamond is already on the termination steps, so it never\nhandles the new request.  As a result, the damos_walk() caller thread\ninfinitely waits.\n\nFix this by introducing another damon_ctx field, namely\nwalk_control_obsolete.  It is protected by the\ndamon_ctx->walk_control_lock, which protects damos_walk() request\nregistration.  Initialize (unset) it in kdamond_fn() before letting\ndamon_start() returns and set it just before the cancelling of the\nremaining damos_walk() request is executed.  damos_walk() reads the\nobsolete field under the lock and avoids adding a new request.\n\nAfter this change, only requests that are guaranteed to be handled or\ncancelled are registered.  Hence the after-registration DAMON context\ntermination check is no longer needed.  Remove it together.\n\nThe issue is found by sashiko [1].","state":0,"publishedAt":"2026-05-27T12:56:08.315+00:00","modifiedAt":"2026-10-21T12:41:10.467+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/damon.h\",\n                        \"mm/damon/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61\",\n                            \"lessThan\": \"93a7f297362deac614ce3dbbba73ff2ba31aaca3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61\",\n                            \"lessThan\": \"0ba956a239ba6e3fae8555d3660e22e675be63b5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61\",\n                            \"lessThan\": \"33c3f6c2b48cd84b441dba1ee3e62290e53930f4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/damon.h\",\n                        \"mm/damon/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.58\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.4\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/93a7f297362deac614ce3dbbba73ff2ba31aaca3","https://git.kernel.org/stable/c/0ba956a239ba6e3fae8555d3660e22e675be63b5","https://git.kernel.org/stable/c/33c3f6c2b48cd84b441dba1ee3e62290e53930f4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46008","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-46008","identifiers":["CVE-2026-46008"]},"retained":false,"historicalAffected":[]}],"coverage":[]}