VulnSocial

CVE-2026-31458General(linux / linux_kernel)

LOWCVSS 5.5 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Multiple sysfs command paths dereference contexts_arr[0] without first verifying that kdamond->contexts->nr == 1. A user can set nr_contexts to 0 via sysfs while DAMON is running, causing NULL pointer dereferences. In more detail, the issue can be triggered by privileged users like below. First, start DAMON and make contexts directory empty (kdamond->contexts->nr == 0). # damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/nr_contexts Then, each of below commands will cause the NULL pointer dereference. # echo update_schemes_stats > state # echo update_schemes_tried_regions > state # echo update_schemes_tried_bytes > state # echo update_schemes_effective_quotas > state # echo update_tuned_intervals > state Guard all commands (except OFF) at the entry point of damon_sysfs_handle_cmd().

linux CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-476

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • linux_kernel

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • General: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-04-22); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
linux
Products
linux_kernel

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-22: 1Mentions · 2026-04-23: 1PoC Mentioned / Linked · 2026-04-23: 1Technical Details · 2026-04-23: 104-2204-23
Signal classification1 categories
General
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • WindowsForum@windowsforum
    General

    🪟 Linux CVE: set nr_contexts to 0 and DAMON faceplants on sysfs thinking contexts_arr[0] still exists. Cool. Nothing like a “NULL deref” to remind us defaults aren’t guarantees. https://windowsforum.com/threads/cve-2026-31458-damon-sysfs-null-dereference-when-nr_contexts-becomes-0.414757/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #LinuxKernelCve #NullDereference #DamonSysfs #KernelReliability https://t.co/ie1uRS7WwD

    Post summary

    The post highlights a null‑dereference issue (CVE‑2026‑31458) in Linux’s DAMON sysfs subsystem, offering a technical description but no PoC, exploit, patch, or evidence of active abuse.

    0000031
    1.1K followersView on X
  • CVE@CVEnew
    General

    CVE-2026-31458 In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Multiple sysfs command paths… https://www.cve.org/CVERecord?id=CVE-2026-31458

    Post summary

    The note simply states CVE‑2026‑31458 in the Linux kernel has been resolved but provides no PoC, exploit, patch details, or technical specifics.

    00000144
    57.2K followersView on X
CPE platform detail6 entries

6 of 6 entries

PartVendorProductVersionTarget SWTarget HW
OSlinuxlinux_kernel---
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--

Explore more

Back to dashboardlinux CVEslinux_kernel vulnerabilities