Cloudanix VulnDB

CVE-2026-99240

None

CVSS

—

EPSS

0.2%

Published

Nov 2, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux memory monitoring could let a bad setting crash the whole system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Division-by-zero error in Linux kernel DAMON core when a DAMOS quota goal has target_value of zero, due to missing input validation in damos_commit_quota_goal().

Why it matters to the business

Potential kernel crashes or system instability on Linux systems using DAMON features, increasing operational risk for workloads relying on memory access monitoring.

How an attack unfolds

An attacker or misconfigured process supplies a DAMOS scheme with zero target_value through DAMON APIs or modules like DAMON_LRU_SORT; the core layer performs arithmetic without validation, triggering division by zero and kernel fault.

How to fix it

Update the Linux kernel to a version containing the core-layer validation fix in mm/damon/core that rejects zero target_value in damos_commit_quota_goal() and propagates the error.

How to confirm the fix worked

Confirm kernel source contains the added check in damos_commit_quota_goal() that returns error on zero target_value; test by attempting to register a scheme with zero target_value and verifying error is returned instead of crash.

Typical attack path

  1. Identify or gain ability to configure DAMON schemes on target system
  2. Create or supply a damos_quota_goal structure with target_value set to zero
  3. Invoke DAMOS commit path via API or module
  4. Trigger division-by-zero in core quota goal evaluation

How to detect it

Review kernel logs for division-by-zero faults or oops in damon code paths; inspect any custom DAMON module code for prior zero-value handling that was removed.

What your security team should do

  • Prioritize kernel updates for systems using DAMON
  • Audit any custom DAMON configurations or modules for zero target_value usage
  • Monitor for kernel oops reports related to damon

The record

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damos_commit_quota_goal() for zero target_value Patch series "mm/damon: move zero damos quota target_value handling to the core layer". Having zero DAMOS quota target value can cause division by zero. DAMON API callers are checking the target value parameters to avoid that. It is easy to make mistakes in some of the multiple API callers. Move that to the core layer. Patch 1 adds the corner case handling into the core layer DAMON parameters validation logic. Patches 2 and 3 remove no more needed DAMON API callers side handling of the corner case in DAMON_LRU_SORT and DMON_SAMPLIE_MTIER, respectively. This patch (of 3): If a DAMOS scheme has a damos_quota_goal of zero target_value, damos_quota_goal() could trigger division-by-zero error. Hence each DAMON API callers should do the zero target_value validation. It is easy to make mistakes. Actually such bugs in DAMON_LRU_SORT and DAMON_SAMPLE_MTIER were found and fixed [1]. It is better to handle the corner case only once in the core layer, instead of multiple places in all DAMON API callers. One straightforward option is using an alternative denominator for the corner case in the damos_quota_goal(). However, the zero target_value is meaningless. In this case, the quota goal is always evaluated as achieved or over-achieved. The quota will only keep being reduced. Simply avoid using zero target_value by adding a check in the core layer DAMOS quota goal parameters validation/commit path, damos_commit_quota_goal(). Update it to return an error in the case. Also update its caller to propagate the error.

Affected packages

Ecosystem Package Introduced Fixed