CVE-2026-46008

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: fix damoswalk() vs kdamondfn() exit race

When kdamondfn() main loop is finished, the function cancels remaining damoswalk() request and unset the damonctx->kdamond so that API callers and API functions themselves can show the context is terminated. damoswalk() adds the caller's request to the queue first. After that, it shows if the kdamond of the damonctx is still running (damonctx->kdamond is set). Only if the kdamond is running, damos_walk() starts waiting for the kdamond's handling of the newly added request.

The damoswalk() requests registration and damonctx->kdamond unset are protected by different mutexes, though. Hence, damoswalk() could race with damonctx->kdamond unset, and result in deadlocks.

For example, let's suppose kdamond successfully finished the damowwalk() request cancelling. Right after that, damoswalk() is called for the context. It registers the new request, and shows the context is still running, because damonctx->kdamond unset is not yet done. Hence the damoswalk() caller starts waiting for the handling of the request. However, the kdamond is already on the termination steps, so it never handles the new request. As a result, the damos_walk() caller thread infinitely waits.

Fix this by introducing another damonctx field, namely walkcontrolobsolete. It is protected by the damonctx->walkcontrollock, which protects damoswalk() request registration. Initialize (unset) it in kdamondfn() before letting damonstart() returns and set it just before the cancelling of the remaining damoswalk() request is executed. damos_walk() reads the obsolete field under the lock and avoids adding a new request.

After this change, only requests that are guaranteed to be handled or cancelled are registered. Hence the after-registration DAMON context termination check is no longer needed. Remove it together.

The issue is found by sashiko [1].