CVE-2026-52905: mm/damon/core: disallow non-power of two min_region_sz on damon_start()
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: disallow non-power of two minregionsz on damonstart()
Commit d8f867fa0825 ("mm/damon: add damonctx->minszregion") introduced a bug that allows unaligned DAMON region address ranges. Commit c80f46ac228b ("mm/damon/core: disallow non-power of two minregionsz") fixed it, but only for damoncommitctx() use case. Still, DAMON sysfs interface can emit non-power of two minregionsz via damonstart(). Fix the path by adding the ispowerof2() check on damonstart().
The issue was discovered by sashiko [1].
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel mm/damon/coreto a version that resolves this vulnerability.Patch c80f46ac228b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52905?
CVE-2026-52905 has a risk score of 34, indicating a moderate level of severity.
How do I fix CVE-2026-52905?
To fix CVE-2026-52905, update to the latest version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2026-52905?
CVE-2026-52905 affects vulnerable versions of the Linux kernel that implement the DAMON functionality.
What is the impact of CVE-2026-52905?
The impact of CVE-2026-52905 allows for unaligned DAMON region address ranges, which can lead to potential data integrity issues.
When was CVE-2026-52905 published?
CVE-2026-52905 was published on June 9, 2026.