CVE-2026-31459

MediumCVSS 5.5/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure

Patch series "mm/damon/sysfs: fix memory leak and NULL dereference issues", v4.

DAMON_SYSFS can leak memory under allocation failure, and do NULL pointer dereference when a privileged user make wrong sequences of control. Fix those.

This patch (of 3):

When damon_sysfs_new_test_ctx() fails in damon_sysfs_commit_input(), param_ctx is leaked because the early return skips the cleanup at the out label. Destroy param_ctx before returning.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
LinuxLinux>= f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f, < e9de9f3ce06b133a348006668bc8d25c6e504867; >= f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f, < f76f0a964bc3d7b7e253b43c669c41356bc54e71; >= f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f, < 7fe000eb32904758a85e62f6ea9483f89d5dabfc; 5b3609d9b9650bdea0bfdf643e0ce57e1aed67fc; >= 6.17.6, < 6.18
LinuxLinux6.18

References

Timeline

Published
Apr 22, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-31465.5A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libCVE-2026-314605.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if ext_caps is valid in BL setup LVDS connectorCVE-2026-314615.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix drm_edid leak in amdgpu_dm [WHAT] When a sink is CVE-2026-314625.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent immediate PASID reuse case PASID resue could causeCVE-2026-314639.8In the Linux kernel, the following vulnerability has been resolved: iomap: fix invalid folio access when i_blkbits differs from I/O granulaCVE-2026-314648.1In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicCVE-2026-314655.5In the Linux kernel, the following vulnerability has been resolved: writeback: don't block sync for filesystems with no data integrity guarCVE-2026-314664.7In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() On arm64CVE-2026-314677.5In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed The bio completionCVE-2026-314687.8In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Fix double free in dma-buf feature The error path through vfCVE-2026-314697.8In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared andCVE-2026-31477.8A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload
CVE-2026-31459: Medium severity, CVSS 5.5 | Vulnix