CVE-2026-46020: mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: validate damosquotagoal->nid for nodemem{used,free}bp
Patch series "mm/damon/core: validate damosquotagoal->nid".
nodemem[cg]{used,free}bp DAMOS quota goals receive the node id. The node id is used for simeminfonode() and NODEDATA() without proper validation. As a result, privileged users can trigger an out of bounds memory access using DAMONSYSFS. Fix the issues.
The issue was originally reported [1] with a fix by another author. The original author announced [2] that they will stop working including the fix that was still in the review stage. Hence I'm restarting this.
This patch (of 2):
Users can set damosquotagoal->nid with arbitrary value for nodemem{used,free}bp. But DAMON core is using those for simeminfonode() without the validation of the value. This can result in out of bounds memory access. The issue can actually triggered using DAMON user-space tool (damo), like below.
$ sudo ./damo start --damosaction stat \ --damosquotagoal nodememusedbp 50% -1 \ --damosquotainterval 1s $ sudo dmesg [...] [ 65.565986] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098
Fix this issue by adding the validation of the given node. If an invalid node id is given, it returns 0% for used memory ratio, and 100% for free memory ratio.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch mm/damon/core: validate damos_quota_goal->nid - Compensating control
Until the kernel patch is applied, avoid running the DAMON user-space tool (damo) and restrict access to DAMON sysfs interfaces (DAMOS_SYSFS) to trusted privileged users or block access via host-based access controls to prevent untrusted privileged users from setting arbitrary damos_quota_goal->nid values.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user with privileges sufficient to configure DAMON through DAMON_SYSFS can trigger it. The example uses sudo and the DAMON user-space tool, damo.
What input triggers the vulnerable path?
The issue is triggered by setting an arbitrary or invalid NUMA node ID in a DAMOS quota goal using node_mem_used_bp or node_mem_free_bp. That node ID is used without validation by kernel memory-information handling.
What is the likely impact of successful exploitation?
An invalid node ID can cause an out-of-bounds memory access and a kernel NULL pointer dereference. The provided CVSS vector indicates high confidentiality impact and high availability impact, with local access and low privileges required.
What should be done if the kernel cannot be patched immediately?
Restrict access to DAMON_SYSFS and prevent untrusted or insufficiently trusted users from creating DAMOS quota goals. In particular, do not allow configurations using node_mem_used_bp or node_mem_free_bp with unvalidated node IDs.