{"id":"CVE-2026-46008","title":"mm/damon/core: fix damos_walk() vs kdamond_fn() exit race","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: fix damos_walk() vs kdamond_fn() exit race\n\nWhen kdamond_fn() main loop is finished, the function cancels remaining\ndamos_walk() request and unset the da…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 < 93a7f297362deac614ce3dbbba73ff2ba31aaca3","Linux >= bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 < 0ba956a239ba6e3fae8555d3660e22e675be63b5","Linux >= bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 < 33c3f6c2b48cd84b441dba1ee3e62290e53930f4","Linux 6.14"],"published":"2026-05-27","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:41:10.467Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46008","references":[{"url":"https://git.kernel.org/stable/c/93a7f297362deac614ce3dbbba73ff2ba31aaca3"},{"url":"https://git.kernel.org/stable/c/0ba956a239ba6e3fae8555d3660e22e675be63b5"},{"url":"https://git.kernel.org/stable/c/33c3f6c2b48cd84b441dba1ee3e62290e53930f4"}],"tags":["cve.org"],"epss":0.00098,"epssPercentile":0.0072,"ingestedAt":"2026-10-21T12:48:53.634Z","slug":"CVE-2026-46008","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: fix damos_walk() vs kdamond_fn() exit race\n\nWhen kdamond_fn() main loop is finished, the function cancels remaining\ndamos_walk() request and unset the damon_ctx->kdamond so that API callers\nand API functions themselves can show the context is terminated. \ndamos_walk() adds the caller's request to the queue first.  After that, it\nshows if the kdamond of the damon_ctx is still running (damon_ctx->kdamond\nis set).  Only if the kdamond is running, damos_walk() starts waiting for\nthe kdamond's handling of the newly added request.\n\nThe damos_walk() requests registration and damon_ctx->kdamond unset are\nprotected by different mutexes, though.  Hence, damos_walk() could race\nwith damon_ctx->kdamond unset, and result in deadlocks.\n\nFor example, let's suppose kdamond successfully finished the damow_walk()\nrequest cancelling.  Right after that, damos_walk() is called for the\ncontext.  It registers the new request, and shows the context is still\nrunning, because damon_ctx->kdamond unset is not yet done.  Hence the\ndamos_walk() caller starts waiting for the handling of the request. \nHowever, the kdamond is already on the termination steps, so it never\nhandles the new request.  As a result, the damos_walk() caller thread\ninfinitely waits.\n\nFix this by introducing another damon_ctx field, namely\nwalk_control_obsolete.  It is protected by the\ndamon_ctx->walk_control_lock, which protects damos_walk() request\nregistration.  Initialize (unset) it in kdamond_fn() before letting\ndamon_start() returns and set it just before the cancelling of the\nremaining damos_walk() request is executed.  damos_walk() reads the\nobsolete field under the lock and avoids adding a new request.\n\nAfter this change, only requests that are guaranteed to be handled or\ncancelled are registered.  Hence the after-registration DAMON context\ntermination check is no longer needed.  Remove it together.\n\nThe issue is found by sashiko [1].\n\n## Affected\n\n- `Linux >= bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 < 93a7f297362deac614ce3dbbba73ff2ba31aaca3`\n- `Linux >= bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 < 0ba956a239ba6e3fae8555d3660e22e675be63b5`\n- `Linux >= bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61 < 33c3f6c2b48cd84b441dba1ee3e62290e53930f4`\n- `Linux 6.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}