---
id: CVE-2025-39877
title: 'mm/damon/sysfs: fix use-after-free in state_show()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/damon/sysfs: fix use-after-free in state_show()

  state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock. 
  This allows a use-after-free race:

  CPU 0  …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a <
    3858c44341ad49dc7544b19cc9f9ecffaa7cc50e
  - >-
    Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a <
    60d7a3d2b985a395318faa1d88da6915fad11c19
  - >-
    Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a <
    26d29b2ac87a2989071755f9828ebf839b560d4c
  - >-
    Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a <
    4e87f461d61959647464a94d11ae15c011be58ce
  - >-
    Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a <
    3260a3f0828e06f5f13fac69fb1999a6d60d9cff
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:12:49.483083Z'
published: '2025-09-23'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:06.295Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39877'
references:
  - url: 'https://git.kernel.org/stable/c/3858c44341ad49dc7544b19cc9f9ecffaa7cc50e'
  - url: 'https://git.kernel.org/stable/c/60d7a3d2b985a395318faa1d88da6915fad11c19'
  - url: 'https://git.kernel.org/stable/c/26d29b2ac87a2989071755f9828ebf839b560d4c'
  - url: 'https://git.kernel.org/stable/c/4e87f461d61959647464a94d11ae15c011be58ce'
  - url: 'https://git.kernel.org/stable/c/3260a3f0828e06f5f13fac69fb1999a6d60d9cff'
tags:
  - cve.org
epss: 0.00154
epssPercentile: 0.04518
ingestedAt: '2026-11-05T22:38:32.045Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs: fix use-after-free in state_show()

state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock. 
This allows a use-after-free race:

CPU 0                         CPU 1
-----                         -----
state_show()                  damon_sysfs_turn_damon_on()
ctx = kdamond->damon_ctx;     mutex_lock(&damon_sysfs_lock);
                              damon_destroy_ctx(kdamond->damon_ctx);
                              kdamond->damon_ctx = NULL;
                              mutex_unlock(&damon_sysfs_lock);
damon_is_running(ctx);        /* ctx is freed */
mutex_lock(&ctx->kdamond_lock); /* UAF */

(The race can also occur with damon_sysfs_kdamonds_rm_dirs() and
damon_sysfs_kdamond_release(), which free or replace the context under
damon_sysfs_lock.)

Fix by taking damon_sysfs_lock before dereferencing the context, mirroring
the locking used in pid_show().

The bug has existed since state_show() first accessed kdamond->damon_ctx.

## Affected

- `Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a < 3858c44341ad49dc7544b19cc9f9ecffaa7cc50e`
- `Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a < 60d7a3d2b985a395318faa1d88da6915fad11c19`
- `Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a < 26d29b2ac87a2989071755f9828ebf839b560d4c`
- `Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a < 4e87f461d61959647464a94d11ae15c011be58ce`
- `Linux >= a61ea561c87139992fe32afdee48a6f6b85d824a < 3260a3f0828e06f5f13fac69fb1999a6d60d9cff`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.