Cloudanix VulnDB

CVE-2026-68165

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug lets certain memory-monitoring settings be configured incorrectly, which can cause errors or crashes on affected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits DAMON API callers to configure zero-length regions, violating the core assumption that such regions do not exist and triggering WARN_ONCE() or divide-by-zero in damon_merge_two_regions().

Why it matters to the business

Systems relying on DAMON for memory monitoring or reclamation may experience kernel warnings, instability, or crashes when empty regions are configured via sysfs or related interfaces.

How an attack unfolds

An attacker with local access to DAMON configuration interfaces (such as sysfs under /sys/kernel/mm/damon) sets matching start and end values for a region, issues a commit, and triggers the invalid state that leads to the warning or arithmetic error.

How to fix it

Update to a kernel containing the validation added to damon_set_regions(); rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the patch by attempting to set zero-length regions under CONFIG_DAMON_DEBUG_SANITY and verifying absence of the 'start >= end' warning; inspect kernel source for the added range checks in damon_set_regions().

Typical attack path

  1. Obtain local access to a system with DAMON enabled
  2. Navigate to DAMON sysfs or call equivalent API to target a region
  3. Write identical values to start and end attributes
  4. Write 'commit' to the state file
  5. Observe resulting kernel warning or divide-by-zero in dmesg

How to detect it

Search kernel logs (dmesg, journalctl) for messages containing 'start .* >= end' or 'WARNING: mm/damon/core.c' originating from damon_new_region or damon_merge_two_regions.

  • start 0 >= end 0
  • WARNING: mm/damon/core.c:359 at damon_new_region
  • kdamond.*divide-by-zero

What your security team should do

  • Prioritize kernel updates that include the damon_set_regions() validation
  • Restrict unprivileged write access to DAMON sysfs paths where feasible
  • Monitor kernel logs for damon_new_region warnings as an interim detection measure

The record

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damon_set_regions() DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT allow users to set empty monitoring target regions. This could result in WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and divide-by-zero from damon_merge_two_regions(). For example, the WANR_ONCE() can be triggered like below. # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r) # CONFIG_DAMON_DEBUG_SANITY=y # damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/0/targets/0/regions/0/start # echo 0 > contexts/0/targets/0/regions/0/end # echo commit > state # dmesg [....] [ 73.705780] ------------[ cut here ]------------ [ 73.707552] start 0 >= end 0 [ 73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758 [...] All DAMON API callers eventually use damon_set_regions() to setup the regions. Add the validation logic in the function.

Affected packages

Ecosystem Package Introduced Fixed