CVE-2026-80592
Estado: RecibidaSin puntuar—
In the Linux kernel, the following vulnerability has been resolved:
samples/damon/mtier: fail early if address range parameters are invalid
The comment on top of `struct damon_region` clearly says that
which is now verified in damon_verify_new_region() if the kernel is built with DAMON_DEBUG_SANITY.
The WARN_ONCE() can be triggered if the mtier sample module is enabled before node{0,1}_{start,end}_addr have been properly initialized, which is obviously not good.
Note that the same issue can happen if detect_node_addresses is true, and node 0 or 1 is memoryless. Fix it together by checking the validity of parameters right before damon_new_region() and fail early if they're invalid.
Detalles técnicos trazas, registros y código del informe original
For any use case, @ar should be non-zero positive size. ------------[ cut here ]------------ start 0 >= end 0 WARNING: mm/damon/core.c:217 at damon_new_region+0xf4/0x118, CPU#59: bash/341468 Call trace: damon_new_region+0xf4/0x118 (P) damon_set_regions+0xfc/0x3c0 damon_sample_mtier_build_ctx+0xe8/0x3a8 damon_sample_mtier_start+0x1c/0x90 damon_sample_mtier_enable_store+0x98/0xb0 param_attr_store+0xb4/0x128 module_attr_store+0x2c/0x50 sysfs_kf_write+0x58/0x90 kernfs_fop_write_iter+0x16c/0x238 vfs_write+0x2c0/0x370 ksys_write+0x74/0x118 __arm64_sys_write+0x24/0x38 invoke_syscall+0xa8/0x118 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x54/0x370 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 ---[ end trace 0000000000000000 ]---
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-80592",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "82a08bde3cf7bbbe90de57baa181bebf676582c7",
"lessThan": "9d360fb820a3b9576d155e720ec44fef54d2efb5",
"versionType": "git"
},
{
"status": "affected",
"version": "82a08bde3cf7bbbe90de57baa181bebf676582c7",
"lessThan": "db20589d7b248211f63f4a7f642a49c0832b13ae",
"versionType": "git"
},
{
"status": "affected",
"version": "82a08bde3cf7bbbe90de57baa181bebf676582c7",
"lessThan": "7746d72c64054976887928d64d2caf25c5a6dcc0",
"versionType": "git"
}
],
"programFiles": [
"samples/damon/mtier.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"samples/damon/mtier.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-28T08:16:42.830",
"references": [
{
"url": "https://git.kernel.org/stable/c/7746d72c64054976887928d64d2caf25c5a6dcc0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9d360fb820a3b9576d155e720ec44fef54d2efb5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/db20589d7b248211f63f4a7f642a49c0832b13ae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/damon/mtier: fail early if address range parameters are invalid\n\nThe comment on top of `struct damon_region` clearly says that\n\n For any use case, @ar should be non-zero positive size.\n\nwhich is now verified in damon_verify_new_region() if the kernel is built\nwith DAMON_DEBUG_SANITY.\n\nThe WARN_ONCE() can be triggered if the mtier sample module is enabled\nbefore node{0,1}_{start,end}_addr have been properly initialized, which is\nobviously not good.\n\n ------------[ cut here ]------------\n start 0 >= end 0\n WARNING: mm/damon/core.c:217 at damon_new_region+0xf4/0x118, CPU#59: bash/341468\n Call trace:\n damon_new_region+0xf4/0x118 (P)\n damon_set_regions+0xfc/0x3c0\n damon_sample_mtier_build_ctx+0xe8/0x3a8\n damon_sample_mtier_start+0x1c/0x90\n damon_sample_mtier_enable_store+0x98/0xb0\n param_attr_store+0xb4/0x128\n module_attr_store+0x2c/0x50\n sysfs_kf_write+0x58/0x90\n kernfs_fop_write_iter+0x16c/0x238\n vfs_write+0x2c0/0x370\n ksys_write+0x74/0x118\n __arm64_sys_write+0x24/0x38\n invoke_syscall+0xa8/0x118\n el0_svc_common.constprop.0+0x48/0xf0\n do_el0_svc+0x24/0x38\n el0_svc+0x54/0x370\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1ac/0x1b0\n ---[ end trace 0000000000000000 ]---\n\nNote that the same issue can happen if detect_node_addresses is true, and\nnode 0 or 1 is memoryless. Fix it together by checking the validity of\nparameters right before damon_new_region() and fail early if they're\ninvalid."
}
],
"lastModified": "2026-08-28T08:16:42.830",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}