Executive brief
The Linux kernel's DAMON memory monitoring subsystem contains a bug that can cause an infinite loop under specific conditions. An attacker or malicious user with the ability to configure DAMON parameters could trigger this loop, causing a denial of service by consuming CPU resources indefinitely. This affects systems using DAMON for memory management and monitoring.
Technical details
The vulnerability is an integer overflow leading to infinite loop in the kdamond_merge_regions() function within DAMON (Data Access Monitor). The root cause is that when the merge threshold exceeds UINT_MAX / 2, doubling it causes an integer overflow, bypassing the loop break condition. The vulnerable code path is triggered when DAMON regions exceed the user-defined upper limit and the system attempts to merge them using progressively higher thresholds. An attacker requires the ability to configure DAMON parameters (particularly aggregation intervals and region setup) to trigger the condition. The practical impact is a kernel hang/denial of service. The fix involves checking the loop break condition before doubling the threshold and preventing threshold overflow.
Affected products
- Linux Linux kernel Linux kernel versions with DAMON support (likely 5.15+)
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix included in patch series