CVE-2026-74643
In the Linux kernel, the following vulnerability has been resolved:
samples/damon/mtier: error out for zero quota goal target values
Patch series "mm/damon: avoid division by zero from damos_quota_score()".
DAMON_SAMPLE_MTIER and DAMON_LRU_SORT allow the user to trigger division by zero in damos_quota_score(). Avoid it by adding parameters validation checks.
This patch (of 2):
damos_quota_score() can trigger division by zero if the target_value is zero. DAMON_SAMPLE_MTIER lets users set the target_value via node0_mem_{used,free}_bp parameters. It doesn't guard zero value case, though. As a result, users can trigger division by zero. Fix the issue by returning an error when the user tries to start DAMON with zero node0_mem_{used,free}_bp parameter values.
Leer descripción completaMostrar menos
DAMON_SAMPLE_MTIER is just a sample module, but the consequence is quite bad. Also the zero node0_mem_free_bp parameter might look like a reasonable setup to some users. Hence, the issue might really happen in the real world.
One reliable way to reproduce the issue is like below:
This issue was discovered [1] by Sashiko.
Detalles técnicos trazas, registros y código del informe original
# cd /sys/module/damon_sample_mtier/parameters
# echo 4096 > node0_start_addr
# echo 8192 > node0_end_addr
# echo 8192 > node1_start_addr
# echo 81920 > node1_end_addr
# echo 0 > node0_mem_free_bp
# echo Y > enabled
# dmesg -w
[...]
[18792.235916] Oops: divide error: 0000 [#1] SMP NOPTI
[...]
[18792.242787] RIP: 0010:damos_quota_score+0x6f/0x480
[...]CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-74643",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "c5e67d40a10234541e220750297304df79aaedd0",
"lessThan": "e16b8d640ec99b28bc827560edcf9706e610c3aa",
"versionType": "git"
},
{
"status": "affected",
"version": "c5e67d40a10234541e220750297304df79aaedd0",
"lessThan": "684f271210becd7b8c4088f06c442499e48a43a0",
"versionType": "git"
},
{
"status": "affected",
"version": "c5e67d40a10234541e220750297304df79aaedd0",
"lessThan": "a16fd3ad9d89b05475864da97327870464611736",
"versionType": "git"
}
],
"programFiles": [
"samples/damon/mtier.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"samples/damon/mtier.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-22T16:16:37.617",
"references": [
{
"url": "https://git.kernel.org/stable/c/684f271210becd7b8c4088f06c442499e48a43a0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a16fd3ad9d89b05475864da97327870464611736",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e16b8d640ec99b28bc827560edcf9706e610c3aa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/damon/mtier: error out for zero quota goal target values\n\nPatch series \"mm/damon: avoid division by zero from damos_quota_score()\".\n\nDAMON_SAMPLE_MTIER and DAMON_LRU_SORT allow the user to trigger division\nby zero in damos_quota_score(). Avoid it by adding parameters validation\nchecks.\n\n\nThis patch (of 2):\n\ndamos_quota_score() can trigger division by zero if the target_value is\nzero. DAMON_SAMPLE_MTIER lets users set the target_value via\nnode0_mem_{used,free}_bp parameters. It doesn't guard zero value case,\nthough. As a result, users can trigger division by zero. Fix the issue\nby returning an error when the user tries to start DAMON with zero\nnode0_mem_{used,free}_bp parameter values.\n\nDAMON_SAMPLE_MTIER is just a sample module, but the consequence is quite\nbad. Also the zero node0_mem_free_bp parameter might look like a\nreasonable setup to some users. Hence, the issue might really happen in\nthe real world.\n\nOne reliable way to reproduce the issue is like below:\n\n # cd /sys/module/damon_sample_mtier/parameters\n # echo 4096 > node0_start_addr\n # echo 8192 > node0_end_addr\n # echo 8192 > node1_start_addr\n # echo 81920 > node1_end_addr\n # echo 0 > node0_mem_free_bp\n # echo Y > enabled\n # dmesg -w\n [...]\n [18792.235916] Oops: divide error: 0000 [#1] SMP NOPTI\n [...]\n [18792.242787] RIP: 0010:damos_quota_score+0x6f/0x480\n [...]\n\nThis issue was discovered [1] by Sashiko."
}
],
"lastModified": "2026-08-22T16:16:37.617",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}