CVE-2026-46067: mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: validate damosquotagoal->nid for nodememcg{used,free}bp
Users can set damosquotagoal->nid with arbitrary value for nodememcg{used,free}bp. But DAMON core is using those for NODE-DATA() without a validation of the value. This can result in out of bounds memory access. The issue can actually triggered using DAMON user-space tool (damo), like below.
$ sudo mkdir /sys/fs/cgroup/foo $ sudo ./damo start --damosaction stat --damosquotainterval 1s \ --damosquotagoal nodememcgusedbp 50% -1 /foo $ sudo dmseg [...] [ 524.181426] Unable to handle kernel paging request at virtual address 0000000000002c00
Fix this issue by adding the validation of the given node id. If an invalid node id is given, it returns 0% for used memory ratio, and 100% for free memory ratio.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add validation of damos_quota_goal->nid in mm/damon/core for node_memcg_used_bp and node_memcg_free_bp (node_memcg_{used,free}_bp) before using the node id to prevent out-of-bounds memory access; handle or reject invalid node ids.
mm/damon/core damos_quota_goal->nid validation = validated (ensure node id is valid)