CVE-2025-39877

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/damon/sysfs: fix use-after-free in state_show()<br /> <br /> state_show() reads kdamond-&gt;damon_ctx without holding damon_sysfs_lock. <br /> This allows a use-after-free race:<br /> <br /> CPU 0 CPU 1<br /> ----- -----<br /> state_show() damon_sysfs_turn_damon_on()<br /> ctx = kdamond-&gt;damon_ctx; mutex_lock(&amp;damon_sysfs_lock);<br /> damon_destroy_ctx(kdamond-&gt;damon_ctx);<br /> kdamond-&gt;damon_ctx = NULL;<br /> mutex_unlock(&amp;damon_sysfs_lock);<br /> damon_is_running(ctx); /* ctx is freed */<br /> mutex_lock(&amp;ctx-&gt;kdamond_lock); /* UAF */<br /> <br /> (The race can also occur with damon_sysfs_kdamonds_rm_dirs() and<br /> damon_sysfs_kdamond_release(), which free or replace the context under<br /> damon_sysfs_lock.)<br /> <br /> Fix by taking damon_sysfs_lock before dereferencing the context, mirroring<br /> the locking used in pid_show().<br /> <br /> The bug has existed since state_show() first accessed kdamond-&gt;damon_ctx.