CVE-2026-74645: mm/damon/lru_sort: error out for >10000 active_mem_bp
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/lrusort: error out for >10000 activemembp
damosquotascore() can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoids setting it as the target value if the parameter value is zero. However, it also sets the cold memory scheme with a target value that is calculated as '10000 - activemembp + 2'. Hence, if a user sets activemembp 10002, the cold memory scheme's quota goal target value can be zero. As a result, division by zero can be triggered. Fix by returning an error when the user tries to start DAMON with >10000 activemembp parameter value.
It makes no sense to set activemembp with 10002. It also requires module parameters write permission to reproduce the issue. That said, the consequence is quite bad.
One reliable way to reproduce the issue is like below:
# cd /sys/module/damonlrusort/parameters # echo 1000 > wmarkshigh # echo 995 > wmarksmid # echo 0 > wmarkslow # echo 10002 > activemembp # echo Y > enabled # dmesg -w [...] [ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI [ 597.428848] RIP: 0010:damosquotascore+0x6f/0x480
This issue was discovered [1] by Sashiko.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Configure active_mem_bp to 10000 or lower; do not start DAMON with a value greater than 10000.
DAMON_LRU_SORT active_mem_bp = 10000 or lower
Event History
Frequently Asked Questions
Who can trigger this issue?
An attacker or user needs permission to write DAMON_LRU_SORT module parameters. The provided reproduction writes directly to /sys/module/damon_lru_sort/parameters and then enables the module.
What configuration is required to reproduce the divide-by-zero?
DAMON_LRU_SORT must be configured with active_mem_bp greater than 10000, such as 10002, and enabled. The example also sets wmarks_high to 1000, wmarks_mid to 995, and wmarks_low to 0 before enabling it.
What is the practical impact if it is triggered?
Triggering the condition causes a kernel divide error and Oops. The description characterizes the consequence as quite bad.
What mitigation is available if the fix cannot be applied immediately?
Prevent untrusted users from obtaining write access to DAMON_LRU_SORT module parameters and do not set active_mem_bp above 10000. The fix rejects attempts to start DAMON with values greater than 10000.