Vulnerability-Lookup

FKIE_CVE-2026-74643

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-14 13:10

Severity

Summary

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damos_quota_score()". DAMON_SAMPLE_MTIER and DAMON_LRU_SORT allow the user to trigger division by zero in damos_quota_score(). Avoid it by adding parameters validation checks. This patch (of 2): damos_quota_score() can trigger division by zero if the target_value is zero. DAMON_SAMPLE_MTIER lets users set the target_value via node0_mem_{used,free}_bp parameters. It doesn't guard zero value case, though. As a result, users can trigger division by zero. Fix the issue by returning an error when the user tries to start DAMON with zero node0_mem_{used,free}_bp parameter values. DAMON_SAMPLE_MTIER is just a sample module, but the consequence is quite bad. Also the zero node0_mem_free_bp parameter might look like a reasonable setup to some users. Hence, the issue might really happen in the real world. One reliable way to reproduce the issue is like below: # cd /sys/module/damon_sample_mtier/parameters # echo 4096 > node0_start_addr # echo 8192 > node0_end_addr # echo 8192 > node1_start_addr # echo 81920 > node1_end_addr # echo 0 > node0_mem_free_bp # echo Y > enabled # dmesg -w [...] [18792.235916] Oops: divide error: 0000 [#1] SMP NOPTI [...] [18792.242787] RIP: 0010:damos_quota_score+0x6f/0x480 [...] This issue was discovered [1] by Sashiko.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/684f271210becd7b8c4088f06c442499e48a43a0
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a16fd3ad9d89b05475864da97327870464611736
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e16b8d640ec99b28bc827560edcf9706e610c3aa

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "samples/damon/mtier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e16b8d640ec99b28bc827560edcf9706e610c3aa",
              "status": "affected",
              "version": "c5e67d40a10234541e220750297304df79aaedd0",
              "versionType": "git"
            },
            {
              "lessThan": "684f271210becd7b8c4088f06c442499e48a43a0",
              "status": "affected",
              "version": "c5e67d40a10234541e220750297304df79aaedd0",
              "versionType": "git"
            },
            {
              "lessThan": "a16fd3ad9d89b05475864da97327870464611736",
              "status": "affected",
              "version": "c5e67d40a10234541e220750297304df79aaedd0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "samples/damon/mtier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/damon/mtier: error out for zero quota goal target values\n\nPatch series \"mm/damon: avoid division by zero from damos_quota_score()\".\n\nDAMON_SAMPLE_MTIER and DAMON_LRU_SORT allow the user to trigger division\nby zero in damos_quota_score().  Avoid it by adding parameters validation\nchecks.\n\n\nThis patch (of 2):\n\ndamos_quota_score() can trigger division by zero if the target_value is\nzero.  DAMON_SAMPLE_MTIER lets users set the target_value via\nnode0_mem_{used,free}_bp parameters.  It doesn\u0027t guard zero value case,\nthough.  As a result, users can trigger division by zero.  Fix the issue\nby returning an error when the user tries to start DAMON with zero\nnode0_mem_{used,free}_bp parameter values.\n\nDAMON_SAMPLE_MTIER is just a sample module, but the consequence is quite\nbad.  Also the zero node0_mem_free_bp parameter might look like a\nreasonable setup to some users.  Hence, the issue might really happen in\nthe real world.\n\nOne reliable way to reproduce the issue is like below:\n\n    # cd /sys/module/damon_sample_mtier/parameters\n    # echo 4096 \u003e node0_start_addr\n    # echo 8192 \u003e node0_end_addr\n    # echo 8192 \u003e node1_start_addr\n    # echo 81920 \u003e node1_end_addr\n    # echo 0 \u003e node0_mem_free_bp\n    # echo Y \u003e enabled\n    # dmesg -w\n    [...]\n    [18792.235916] Oops: divide error: 0000 [#1] SMP NOPTI\n    [...]\n    [18792.242787] RIP: 0010:damos_quota_score+0x6f/0x480\n    [...]\n\nThis issue was discovered [1] by Sashiko."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nsamples/damon/mtier: error al salir por valores objetivo de cuota cero\n\nSerie de parches \u201cmm/damon: evitar la divisi\u00f3n por cero de damos_quota_score()\u201d.\n\nDAMON_SAMPLE_MTIER y DAMON_LRU_SORT permiten al usuario activar la divisi\u00f3n por cero en damos_quota_score(). Ev\u00edtelo a\u00f1adiendo comprobaciones de validaci\u00f3n de par\u00e1metros.\n\nEste parche (de 2):\n\ndamos_quota_score() puede activar la divisi\u00f3n por cero si el target_value es cero. DAMON_SAMPLE_MTIER permite a los usuarios establecer el target_value a trav\u00e9s de los par\u00e1metros node0_mem_{used,free}_bp. Sin embargo, no protege el caso de valor cero. Como resultado, los usuarios pueden activar la divisi\u00f3n por cero. Solucione el problema devolviendo un error cuando el usuario intente iniciar DAMON con valores de par\u00e1metro node0_mem_{used,free}_bp cero.\n\nDAMON_SAMPLE_MTIER es solo un m\u00f3dulo de ejemplo, pero la consecuencia es bastante mala. Adem\u00e1s, el par\u00e1metro node0_mem_free_bp cero podr\u00eda parecer una configuraci\u00f3n razonable para algunos usuarios. Por lo tanto, el problema podr\u00eda ocurrir realmente en el mundo real.\n\nUna forma fiable de reproducir el problema es la siguiente:\n\n    # cd /sys/module/damon_sample_mtier/parameters\n    # echo 4096 \u003e node0_start_addr\n    # echo 8192 \u003e node0_end_addr\n    # echo 8192 \u003e node1_start_addr\n    # echo 81920 \u003e node1_end_addr\n    # echo 0 \u003e node0_mem_free_bp\n    # echo Y \u003e enabled\n    # dmesg -w\n    [...]\n    [18792.235916] Oops: error de divisi\u00f3n: 0000 [#1] SMP NOPTI\n    [...]\n    [18792.242787] RIP: 0010:damos_quota_score+0x6f/0x480\n    [...]\n\nEste problema fue descubierto [1] por Sashiko."
    }
  ],
  "id": "CVE-2026-74643",
  "lastModified": "2026-10-14T13:10:00.187",
  "metrics": {},
  "published": "2026-08-22T16:16:37.617",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/684f271210becd7b8c4088f06c442499e48a43a0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a16fd3ad9d89b05475864da97327870464611736"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e16b8d640ec99b28bc827560edcf9706e610c3aa"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-74643 (GCVE-0-2026-74643)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-22 15:32

Title

samples/damon/mtier: error out for zero quota goal target values

Summary

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6666 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/e16b8d640ec99b28b…
https://git.kernel.org/stable/c/684f271210becd7b8…
https://git.kernel.org/stable/c/a16fd3ad9d89b0547…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c5e67d40a10234541e220750297304df79aaedd0 , < e16b8d640ec99b28bc827560edcf9706e610c3aa (git) Affected: c5e67d40a10234541e220750297304df79aaedd0 , < 684f271210becd7b8c4088f06c442499e48a43a0 (git) Affected: c5e67d40a10234541e220750297304df79aaedd0 , < a16fd3ad9d89b05475864da97327870464611736 (git)
Linux	Linux	Affected: 6.17 Unaffected: 0 , < 6.17 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "samples/damon/mtier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e16b8d640ec99b28bc827560edcf9706e610c3aa",
              "status": "affected",
              "version": "c5e67d40a10234541e220750297304df79aaedd0",
              "versionType": "git"
            },
            {
              "lessThan": "684f271210becd7b8c4088f06c442499e48a43a0",
              "status": "affected",
              "version": "c5e67d40a10234541e220750297304df79aaedd0",
              "versionType": "git"
            },
            {
              "lessThan": "a16fd3ad9d89b05475864da97327870464611736",
              "status": "affected",
              "version": "c5e67d40a10234541e220750297304df79aaedd0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "samples/damon/mtier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/damon/mtier: error out for zero quota goal target values\n\nPatch series \"mm/damon: avoid division by zero from damos_quota_score()\".\n\nDAMON_SAMPLE_MTIER and DAMON_LRU_SORT allow the user to trigger division\nby zero in damos_quota_score().  Avoid it by adding parameters validation\nchecks.\n\n\nThis patch (of 2):\n\ndamos_quota_score() can trigger division by zero if the target_value is\nzero.  DAMON_SAMPLE_MTIER lets users set the target_value via\nnode0_mem_{used,free}_bp parameters.  It doesn\u0027t guard zero value case,\nthough.  As a result, users can trigger division by zero.  Fix the issue\nby returning an error when the user tries to start DAMON with zero\nnode0_mem_{used,free}_bp parameter values.\n\nDAMON_SAMPLE_MTIER is just a sample module, but the consequence is quite\nbad.  Also the zero node0_mem_free_bp parameter might look like a\nreasonable setup to some users.  Hence, the issue might really happen in\nthe real world.\n\nOne reliable way to reproduce the issue is like below:\n\n    # cd /sys/module/damon_sample_mtier/parameters\n    # echo 4096 \u003e node0_start_addr\n    # echo 8192 \u003e node0_end_addr\n    # echo 8192 \u003e node1_start_addr\n    # echo 81920 \u003e node1_end_addr\n    # echo 0 \u003e node0_mem_free_bp\n    # echo Y \u003e enabled\n    # dmesg -w\n    [...]\n    [18792.235916] Oops: divide error: 0000 [#1] SMP NOPTI\n    [...]\n    [18792.242787] RIP: 0010:damos_quota_score+0x6f/0x480\n    [...]\n\nThis issue was discovered [1] by Sashiko."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:21.140Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e16b8d640ec99b28bc827560edcf9706e610c3aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/684f271210becd7b8c4088f06c442499e48a43a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a16fd3ad9d89b05475864da97327870464611736"
        }
      ],
      "title": "samples/damon/mtier: error out for zero quota goal target values",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74643",
    "datePublished": "2026-08-22T15:32:21.140Z",
    "dateReserved": "2026-08-15T05:44:03.922Z",
    "dateUpdated": "2026-08-22T15:32:21.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted