CVE-2026-68165: mm/damon/core: validate ranges in damon_set_regions()
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: validate ranges in damonsetregions()
DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring target regions. This could result in WARNONCE() on CONFIGDAMONDEBUGSANITY enabled kernel, and divide-by-zero from damonmergetworegions().
For example, the WANRONCE() can be triggered like below.
# grep DAMONDEBUGSANITY /boot/config-$(uname -r) # CONFIGDAMONDEBUGSANITY=y # damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/0/targets/0/regions/0/start # echo 0 > contexts/0/targets/0/regions/0/end # echo commit > state # dmesg [....] [ 73.705780] ------------[ cut here ]------------ [ 73.707552] start 0 >= end 0 [ 73.708452] WARNING: mm/damon/core.c:359 at damonnewregion+0x6e/0x80, CPU#1: kdamond.0/758 [...]
All DAMON API callers eventually use damonsetregions() to setup the regions. Add the validation logic in the function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68165?
CVE-2026-68165 has a risk rating of 17, indicating a significant security issue.
How do I fix CVE-2026-68165?
To fix CVE-2026-68165, ensure your Linux kernel is updated to the latest version that addresses this vulnerability.
What issue does CVE-2026-68165 address in the Linux kernel?
CVE-2026-68165 addresses the improper validation of empty region ranges in DAMON core logic.
Which components are affected by CVE-2026-68165?
CVE-2026-68165 affects the DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM, and DAMON_LRU_SORT.
When was CVE-2026-68165 published?
CVE-2026-68165 was published on August 10, 2026.