Executive brief
The Linux kernel's DAMON (Data Access Monitor) memory monitoring subsystem can crash or corrupt memory when applying minimum region count settings. If memory allocation fails during region splitting, the code attempts to access invalid memory addresses, potentially causing kernel panics or silent data corruption on systems using DAMON.
Technical details
The vulnerability exists in mm/damon/core.c in the damon_apply_min_nr_regions() function, which splits memory regions to enforce a user-defined minimum region count. The function calls damon_split_region_at() in a loop but did not check the return value for memory allocation failures. When damon_split_region_at() fails to allocate memory for a new region structure, it returns without updating the region list, but the code continues as if the split succeeded. If the failed region was the last in a linked list, subsequent pointer dereferences fetch invalid memory addresses, causing potential kernel panic or corruption. The fix changes damon_split_region_at() to return an int status code (0 on success, -ENOMEM on failure) and adds error handling to break out of all splitting loops on any allocation failure. This is a local attack surface with no user interaction required, affecting systems running Linux 7.1.x and later kernels with DAMON enabled.
Affected products
- Linux Linux kernel 7.1.x through at least 6.12.y (and later stable branches)
Timeline
- 2026-09-16: disclosed: CVE-2026-90004 published
- 2026-08-06: patched: Fix committed upstream by Andrew Morton (commit c608748607620f331196ed0ba9fe4017892c1457)
- 2026-09-11: patched: Fix backported to stable trees