Executive brief
A vulnerability was identified in the Linux kernel's Data Access Monitor (DAMON) component, which is used for monitoring memory access patterns. The flaw allows the system to accept invalid configuration settings that could lead to unaligned memory region ranges. While primarily a technical consistency issue, it could potentially affect the stability or monitoring accuracy of the operating system's memory management.
Technical details
A bug in the DAMON (Data Access Monitor) core allowed unaligned region address ranges because the 'min_region_sz' parameter was not strictly validated to be a power of two during the 'damon_start()' execution path. While a previous fix addressed this for 'damon_commit_ctx()', the sysfs interface remained vulnerable when initiating monitoring. An attacker with local access to sysfs could provide non-power-of-two values, potentially causing unexpected behavior in memory monitoring logic. The fix implements an 'is_power_of_2()' check within 'damon_start()' to ensure all contexts meet alignment requirements before monitoring begins.
Affected products
- Linux Linux Kernel 6.18.x
Timeline
- 2026-04-11: disclosed: Initial patch submitted by SeongJae Park
- 2026-06-09: advisory: CVE-2026-52905 published