CVE-2026-53335: Linux Kernel DAMON LRU Sort NULL Pointer Dereference DoS

Technical summary

CVE-2026-53335 is a NULL pointer dereference vulnerability in mm/damon/lru_sort within the Linux kernel. The damon_lru_sort_enabled_store() function fails to validate whether damon_ctx allocation succeeded before calling damon_commit_ctx(). If memory allocation fails and ctx remains NULL, the function dereferences the NULL pointer, violating CWE-476 (Null Pointer Dereference). The fix adds an explicit NULL check that returns -ENOMEM when allocation fails, preventing the crash.

Business impact

A successful exploitation results in a kernel panic, rendering the affected system unavailable. This creates a direct denial-of-service exposure for any Linux system running a vulnerable kernel with DAMON LRU sort capability. Organizations using Linux in production environments—particularly cloud platforms, containerized infrastructure, and virtualization hosts—face service disruption risk from unprivileged users. While exploitation requires local access and explicit interaction with the sysfs interface, the low barrier to trigger and high impact make this operationally significant.

Affected systems

The vulnerability affects the Linux kernel across multiple versions. All systems running affected Linux kernel versions with DAMON (Data Access Monitoring) LRU sort module enabled are vulnerable. This includes standard distributions that compile in DAMON support. Verify your specific kernel version against vendor advisories and check whether DAMON_LRU_SORT is compiled into your running kernel (check CONFIG_DAMON_LRU_SORT in kernel config).

Exploitability

The vulnerability requires local access and unprivileged execution context (PR:L in CVSS vector). An authenticated local user can enable DAMON LRU sort through the sysfs interface (/sys/modules/damon_lru_sort/parameters/), and if memory allocation fails—either naturally under memory pressure or through resource-constrained scenarios—trigger a NULL dereference and kernel panic. No network access or elevated privileges are required, making it accessible from any user account on the system.

Remediation

Apply the kernel patch that adds NULL pointer validation in damon_lru_sort_enabled_store(). The fix is straightforward: check if ctx is NULL after allocation attempt and return -ENOMEM if allocation failed. Verify the patch version against your Linux distribution's advisory and test in a non-production environment before deployment. Until patching is feasible, consider disabling DAMON_LRU_SORT if not actively used by monitoring or memory management tools.

Patch guidance

Check your Linux vendor's security advisory for the specific kernel version and patch release that addresses CVE-2026-53335. Patch availability and version numbering varies by distribution (Ubuntu, Red Hat, Debian, SUSE, etc.). Most stable release kernels will receive backported fixes; verify the exact version from your vendor's announcement. Test the patched kernel in your environment before production rollout, as kernel updates typically require system restart.

Detection guidance

Monitor system logs for kernel panics or oops messages referencing mm/damon/lru_sort or damon_commit_ctx. On systems where user interaction with /sys/modules/damon_lru_sort/parameters/ is unexpected, use auditd or similar tools to log sysfs writes. Memory pressure scenarios combined with DAMON LRU sort enable attempts may indicate exploitation. Check whether DAMON_LRU_SORT is actually enabled and necessary in your kernel config (CONFIG_DAMON_LRU_SORT=y); if not in use, disabling it eliminates exposure.

Why prioritize this

Although CVSS rates this as medium severity (5.5), operational impact is significant because kernel crashes directly cause service outages. The low complexity and unprivileged access requirement make it a realistic threat from local users or compromised processes. Organizations should prioritize patching systems in production environments, especially cloud and container hosts where workload density amplifies impact. The fix is low-risk and straightforward, further supporting rapid deployment.

Risk score, explained

CVSS 3.1 base score of 5.5 (MEDIUM) reflects the local-only attack vector (AV:L), low access complexity (AC:L), unprivileged privilege level (PR:L), absence of user interaction (UI:N), and single system scope (S:U). The vulnerability denies availability (A:H) but does not compromise confidentiality or integrity. The score appropriately weights the operational severity against the requirement for local access. However, organizations should assess their own risk considering the frequency of kernel updates and recovery procedures for denial-of-service events.

Frequently asked questions