From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3EDFF39280A for ; Sat, 25 Jul 2026 09:00:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784970004; cv=none; b=XTQGjfMuS48+Mzs8JzOJ3Q18PlcSag86aDLzcXLzxC2q5r2uTWjRegRRfh9ZU0gHxpEO4Hkt8rE5PTh3/AJbtJS0K3uSP54gza1zUBRNDJzgxEnVvF2uFqMokXTbpewvEHO5Jhw2eKd97B+39wQR+daJVeoequcAgtK9Jwu6zAI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784970004; c=relaxed/simple; bh=Nir80svLV9JcIh4OwZf1RXcGl1D9je4UwOwMzhEGA/I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=g/V07U60LTEP5Ikn+AVzRRs5YFkkLKhiRGG9TUG0+zSCQYluVpnjAhZLmT2IAiOuvi+urH6NAqauFspH7QBpccNi4bkf+Qbc7patDAPRba0/evmmci2oqRjVOWbWUuG/UycjjDQ6jQm1P/25ks2wowbIou27ljiT7z2rYRoJhIk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=z8mloKBb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="z8mloKBb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79F971F000E9; Sat, 25 Jul 2026 09:00:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784970003; bh=PL8+se1ea4Cu5OraZntXzVY+HS93NB3laPEb6ClplKo=; h=From:To:Cc:Subject:Date:Reply-To; b=z8mloKBbwr7ZP8FkYqOYAZ5yiBr17vQYb8c0j5S2pQTP7Qb0RIlXBxwrEuvX/6mZb Tmiqh7jnseBzLldAVZsVfCjWkOoV/RfvmvJ28bdgbFAVVle/i/qc9u3e1xbNr6mkNv yOtomFo/KtCBRhlnr7Z4uj//WIqrvPBb9+EYsfqk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64458: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Date: Sat, 25 Jul 2026 10:51:15 +0200 Message-ID: <2026072542-CVE-2026-64458-fb85@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4484; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=+Y4wAVf/GIkrpCugVrBa2+LgYi6/L8x0YpsqtJh+IYs=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkpFVmX7vDu+Lim7f6mqa/5hD7eP9zI1eDZu77XUJnvh Pj6tIyrHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjAR4w0MC47t3lZ39JWPzTs+ Dl7u8sJzEz7NLGRYMN/fVYt3/bMY7pU6lwT3NJibvN21BQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the user sets sampling interval zero, damon_max_nr_accesses(), which is called from damon_hot_score(), causes a divide-by-zero. Needless to say, it is a problem. When the user sets the aggregation interval zero, the function returns zero. It is wrong, since the real maximum nr_acceses in the setup should be one. Worse yet, it can cause another divide-by-zero from its caller, damon_hot_score(), since it uses damon_max_nr_accesses() return value as a denominator. When the user sets the aggregation interval very high, damon_hot_score() could return a value out of [0, DAMOS_MAX_SCORE] range. Since the return value is used as an index to the regions_score_histogram array, which is DAMOS_MAX_SCORE+1 size, it causes out of bounds array access. The issues can be relatively easily reproduced like below. The sysfs write permission is required, though. # ./damo start --damos_action lru_prio --damos_quota_space 100M \ --damos_quota_interval 1s # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/0/monitoring_attrs/intervals/sample_us # echo 0 > contexts/0/monitoring_attrs/intervals/aggr_us # echo commit > state # dmesg [...] [ 131.329762] Oops: divide error: 0000 [#1] SMP NOPTI [...] [ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0 [...] Fix the divide-by-zero intervals problems by explicitly handling the zero intervals in damon_max_nr_accesses(). Fix the out-of-bound array access by applying [0, DAMOS_MAX_SCORE] bounds before returning from damon_hot_score(). The issue was discovered [1] by Sashiko. The Linux kernel CVE team has assigned CVE-2026-64458 to this issue. Affected and fixed versions =========================== Issue introduced in 5.16 with commit 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f and fixed in 6.1.178 with commit 58321b4e6e4f0f412069ab27ccdd56292757343a Issue introduced in 5.16 with commit 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f and fixed in 6.6.145 with commit 74fef68d521150281e36cdaa20e9e1ee3e3aa146 Issue introduced in 5.16 with commit 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f and fixed in 6.12.96 with commit ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a Issue introduced in 5.16 with commit 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f and fixed in 6.18.39 with commit 9c8f31eaae6140ecadec0c07320498a944556de2 Issue introduced in 5.16 with commit 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f and fixed in 7.1.4 with commit 76e415ea88d20f022ed5cfcf78c50e156a267e91 Issue introduced in 5.16 with commit 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f and fixed in 7.2-rc3 with commit 35d4a3cf70a855b50e53189ac2f8463e20a02046 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64458 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/linux/damon.h mm/damon/ops-common.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/58321b4e6e4f0f412069ab27ccdd56292757343a https://git.kernel.org/stable/c/74fef68d521150281e36cdaa20e9e1ee3e3aa146 https://git.kernel.org/stable/c/ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a https://git.kernel.org/stable/c/9c8f31eaae6140ecadec0c07320498a944556de2 https://git.kernel.org/stable/c/76e415ea88d20f022ed5cfcf78c50e156a267e91 https://git.kernel.org/stable/c/35d4a3cf70a855b50e53189ac2f8463e20a02046