{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.11-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  mm/damon/core: avoid use of half-online-committed context  One major usage of damon_call() is online DAMON parameters update.  It is done by calling damon_commit_ctx() inside the damon_call() callback function.  damon_commit_ctx() can fail for two reasons: 1) invalid parameters and 2) internal memory allocation failures.  In case of failures, the damon_ctx that attempted to be updated (commit destination) can be partially updated (or, corrupted from a perspective), and therefore shouldn't be used anymore.  The function only ensures the damon_ctx object can safely deallocated using damon_destroy_ctx().  The API callers are, however, calling damon_commit_ctx() only after asserting the parameters are valid, to avoid damon_commit_ctx() fails due to invalid input parameters.  But it can still theoretically fail if the internal memory allocation fails.  In the case, DAMON may run with the partially updated damon_ctx.  This can result in unexpected behaviors including even NULL pointer dereference in case of damos_commit_dests() failure [1].  Such allocation failure is arguably too small to fail, so the real world impact would be rare.  But, given the bad consequence, this needs to be fixed.  Avoid such partially-committed (maybe-corrupted) damon_ctx use by saving the damon_commit_ctx() failure on the damon_ctx object.  For this, introduce damon_ctx-\u003emaybe_corrupted field.  damon_commit_ctx() sets it when it is failed.  kdamond_call() checks if the field is set after each damon_call_control-\u003efn() is executed.  If it is set, ignore remaining callback requests and return.  All kdamond_call() callers including kdamond_fn() also check the maybe_corrupted field right after kdamond_call() invocations.  If the field is set, break the kdamond_fn() main loop so that DAMON sill doesn't use the context that might be corrupted.  [sj@kernel.org: let kdamond_call() with cancel regardless of maybe_corrupted]",
  "id": "DEBIAN-CVE-2026-31445",
  "modified": "2026-09-14T16:47:38.668663364Z",
  "published": "2026-04-22T14:16:38.177Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-31445"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-31445"
  ]
}