CVE-2026-80592: samples/damon/mtier: fail early if address range parameters are invalid
In the Linux kernel, the following vulnerability has been resolved:
samples/damon/mtier: fail early if address range parameters are invalid
The comment on top of struct damonregion clearly says that
For any use case, @ar should be non-zero positive size.
which is now verified in damonverifynewregion() if the kernel is built with DAMONDEBUGSANITY.
The WARNONCE() can be triggered if the mtier sample module is enabled before node{0,1}{start,end}addr have been properly initialized, which is obviously not good.
------------[ cut here ]------------ start 0 >= end 0 WARNING: mm/damon/core.c:217 at damonnewregion+0xf4/0x118, CPU#59: bash/341468 Call trace: damonnewregion+0xf4/0x118 (P) damonsetregions+0xfc/0x3c0 damonsamplemtierbuildctx+0xe8/0x3a8 damonsamplemtierstart+0x1c/0x90 damonsamplemtierenablestore+0x98/0xb0 paramattrstore+0xb4/0x128 moduleattrstore+0x2c/0x50 sysfskfwrite+0x58/0x90 kernfsfopwriteiter+0x16c/0x238 vfswrite+0x2c0/0x370 ksyswrite+0x74/0x118 arm64syswrite+0x24/0x38 invokesyscall+0xa8/0x118 el0svccommon.constprop.0+0x48/0xf0 doel0svc+0x24/0x38 el0svc+0x54/0x370 el0t64synchandler+0xa0/0xe8 el0t64sync+0x1ac/0x1b0 ---[ end trace 0000000000000000 ]---
Note that the same issue can happen if detectnodeaddresses is true, and node 0 or 1 is memoryless. Fix it together by checking the validity of parameters right before damonnewregion() and fail early if they're invalid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
Which systems are exposed to the warning condition?
Systems using the Linux kernel mtier sample module are exposed if the module is enabled before its node0/node1 start and end address parameters have been properly initialized. The issue is described in the samples/damon/mtier component.
What action triggers the problem?
Enabling the mtier sample module through its sysfs enable control can trigger the condition when an address range has a start address greater than or equal to its end address. The reported call trace shows the trigger occurring during the module enable operation.
How can the condition be identified?
Affected systems can log a WARN_ONCE message stating "start 0 >= end 0" from mm/damon/core.c during mtier module startup. This occurs when DAMON_DEBUG_SANITY is enabled and invalid region parameters are verified.
What can be done before applying an update?
Do not enable the mtier sample module until node0/node1 start and end address parameters have been initialized to non-zero, positive-size ranges. Ensure each range has a start address lower than its end address.