FKIE_CVE-2026-74645

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-14 13:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: error out for >10000 active_mem_bp damos_quota_score() can trigger division by zero if the target value is zero. DAMON_LRU_SORT lets users set the target value for the hot memory scheme via active_mem_bp parameter. It avoids setting it as the target value if the parameter value is zero. However, it also sets the cold memory scheme with a target value that is calculated as '10000 - active_mem_bp + 2'. Hence, if a user sets active_mem_bp 10002, the cold memory scheme's quota goal target value can be zero. As a result, division by zero can be triggered. Fix by returning an error when the user tries to start DAMON with >10000 active_mem_bp parameter value. It makes no sense to set active_mem_bp with 10002. It also requires module parameters write permission to reproduce the issue. That said, the consequence is quite bad. One reliable way to reproduce the issue is like below: # cd /sys/module/damon_lru_sort/parameters # echo 1000 > wmarks_high # echo 995 > wmarks_mid # echo 0 > wmarks_low # echo 10002 > active_mem_bp # echo Y > enabled # dmesg -w [...] [ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI [ 597.428848] RIP: 0010:damos_quota_score+0x6f/0x480 This issue was discovered [1] by Sashiko.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/06befa61c427e74319781e6f35a364cfc32dbae8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e7e5e5e0dfe2ea171044c24c263efae4ee882b3f
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/damon/lru_sort.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7e5e5e0dfe2ea171044c24c263efae4ee882b3f",
              "status": "affected",
              "version": "40d98d31cd7060228e03303c5c34ae7101020416",
              "versionType": "git"
            },
            {
              "lessThan": "06befa61c427e74319781e6f35a364cfc32dbae8",
              "status": "affected",
              "version": "40d98d31cd7060228e03303c5c34ae7101020416",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/damon/lru_sort.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/lru_sort: error out for \u003e10000 active_mem_bp\n\ndamos_quota_score() can trigger division by zero if the target value is\nzero.  DAMON_LRU_SORT lets users set the target value for the hot memory\nscheme via active_mem_bp parameter.  It avoids setting it as the target\nvalue if the parameter value is zero.  However, it also sets the cold\nmemory scheme with a target value that is calculated as \u002710000 -\nactive_mem_bp + 2\u0027.  Hence, if a user sets active_mem_bp 10002, the cold\nmemory scheme\u0027s quota goal target value can be zero.  As a result,\ndivision by zero can be triggered.  Fix by returning an error when the\nuser tries to start DAMON with \u003e10000 active_mem_bp parameter value.\n\nIt makes no sense to set active_mem_bp with 10002.  It also requires\nmodule parameters write permission to reproduce the issue.  That said, the\nconsequence is quite bad.\n\nOne reliable way to reproduce the issue is like below:\n\n    # cd /sys/module/damon_lru_sort/parameters\n    # echo 1000 \u003e wmarks_high\n    # echo 995 \u003e wmarks_mid\n    # echo 0 \u003e wmarks_low\n    # echo 10002 \u003e active_mem_bp\n    # echo Y \u003e enabled\n    # dmesg -w\n    [...]\n    [  597.421247] Oops: divide error: 0000 [#1] SMP NOPTI\n    [  597.428848] RIP: 0010:damos_quota_score+0x6f/0x480\n\nThis issue was discovered [1] by Sashiko."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/lru_sort: devuelve un error para \u003e10000 active_mem_bp\n\ndamos_quota_score() puede desencadenar una divisi\u00f3n por cero si el valor objetivo es cero. DAMON_LRU_SORT permite a los usuarios establecer el valor objetivo para el esquema de memoria caliente a trav\u00e9s del par\u00e1metro active_mem_bp. Evita establecerlo como valor objetivo si el valor del par\u00e1metro es cero. Sin embargo, tambi\u00e9n establece el esquema de memoria fr\u00eda con un valor objetivo que se calcula como \u002710000 - active_mem_bp + 2\u0027. Por lo tanto, si un usuario establece active_mem_bp en 10002, el valor objetivo de la cuota del esquema de memoria fr\u00eda puede ser cero. Como resultado, se puede desencadenar una divisi\u00f3n por cero. Se soluciona devolviendo un error cuando el usuario intenta iniciar DAMON con un valor de par\u00e1metro active_mem_bp \u003e10000.\n\nNo tiene sentido establecer active_mem_bp en 10002. Tambi\u00e9n requiere permiso de escritura para los par\u00e1metros del m\u00f3dulo para reproducir el problema. Dicho esto, la consecuencia es bastante grave.\n\nUna forma fiable de reproducir el problema es la siguiente:\n\n    # cd /sys/module/damon_lru_sort/parameters\n    # echo 1000 \u003e wmarks_high\n    # echo 995 \u003e wmarks_mid\n    # echo 0 \u003e wmarks_low\n    # echo 10002 \u003e active_mem_bp\n    # echo Y \u003e enabled\n    # dmesg -w\n    [...]\n    [  597.421247] Oops: divide error: 0000 [#1] SMP NOPTI\n    [  597.428848] RIP: 0010:damos_quota_score+0x6f/0x480\n\nEste problema fue descubierto [1] por Sashiko."
    }
  ],
  "id": "CVE-2026-74645",
  "lastModified": "2026-10-14T13:10:00.187",
  "metrics": {},
  "published": "2026-08-22T16:16:37.837",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/06befa61c427e74319781e6f35a364cfc32dbae8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e7e5e5e0dfe2ea171044c24c263efae4ee882b3f"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.