PT-2026-43887 · Linux · Linux

Published

2026-05-27

·

Updated

2026-05-27

·

CVE-2026-46020

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: validate damos quota goal->nid for node mem {used,free} bp
Patch series "mm/damon/core: validate damos quota goal->nid".
node mem[cg] {used,free} bp DAMOS quota goals receive the node id. The node id is used for si meminfo node() and NODE DATA() without proper validation. As a result, privileged users can trigger an out of bounds memory access using DAMON SYSFS. Fix the issues.
The issue was originally reported [1] with a fix by another author. The original author announced [2] that they will stop working including the fix that was still in the review stage. Hence I'm restarting this.
This patch (of 2):
Users can set damos quota goal->nid with arbitrary value for node mem {used,free} bp. But DAMON core is using those for si meminfo node() without the validation of the value. This can result in out of bounds memory access. The issue can actually triggered using DAMON user-space tool (damo), like below.
$ sudo ./damo start --damos action stat --damos quota goal node mem used bp 50% -1 --damos quota interval 1s $ sudo dmesg [...] [ 65.565986] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098
Fix this issue by adding the validation of the given node. If an invalid node id is given, it returns 0% for used memory ratio, and 100% for free memory ratio.

Related Identifiers

CVE-2026-46020

Affected Products

Linux