From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B49830D40E for ; Fri, 28 Aug 2026 06:49:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899743; cv=none; b=AXJVW5rwQmBtLxQ+9RkrW+BjYg+IsQiN/R1fMEwBVdA6AJ3XFhewNej0WpeNvDJilspboEgjAxpQ4Sd2I/I+tEo7/T1J0TNl1r9xGYIA7J/ZoC+FfDP8S2c7GmQDODhfrNUby1iW1I8DVRX6pJ7abtLwaR2lyIRk4hqgAuHqNSQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899743; c=relaxed/simple; bh=G6rs+wjLC4Gai+mkFTkqwMNfB9Jd4O6q6GCwWemDPUw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=TCLhG86nTNecKDr7OYj87f57Qjq+ZIp/u8Oq/v5jm5ifZrcupbJ57SpOPU5HyXlxlKD4MZOTOLgYUW0wwmIz3WG7sUKmf7sI9FyzXnpA8WfFFaEVyyWU+xw82HZ4mszZNlYYltoCb5Hk7aIcs+hYpHnkZrRv3Lz0bTW0A1bKNP8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zxtoM2n9; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="zxtoM2n9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E1C51F000E9; Fri, 28 Aug 2026 06:49:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787899742; bh=XRc2Un/VqegISEH1WMfE7K/RLJgvzKeYx+vmAV8AVwE=; h=From:To:Cc:Subject:Date:Reply-To; b=zxtoM2n9rxR8LWaffhqNrIL3KYBiFCsbaH8M5EwEqC/L3X8be5FXONMQ6e/bpUwNg R7yAIPlGoWQQhVhYXi/wStJCIHBSK8YaguLfyQaJGVHZc9e+vHNQAz+MlT+3NdpHNP TPaU5RsFFy0pHXk1S0ReABS/lsqrlURjvy/l8AZI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80592: samples/damon/mtier: fail early if address range parameters are invalid Date: Fri, 28 Aug 2026 08:48:29 +0200 Message-ID: <2026082829-CVE-2026-80592-bc8c@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3405; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=loAibnrszMsXGjDQIoETOAAVeStVUcoKwQ3t8XXKjaM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkT9W01TSaleK45X71uXWY9L/O3eXeWSUqpxlQ9Y7Fjk 3mlLB7eEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABN5fothwa7jK0wPPpxW0JKT P6OlYVNbR5eDEcNc4ZL952peegoVbRDOOL2YaVX18tthAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range parameters are invalid The comment on top of `struct damon_region` clearly says that For any use case, @ar should be non-zero positive size. which is now verified in damon_verify_new_region() if the kernel is built with DAMON_DEBUG_SANITY. The WARN_ONCE() can be triggered if the mtier sample module is enabled before node{0,1}_{start,end}_addr have been properly initialized, which is obviously not good. ------------[ cut here ]------------ start 0 >= end 0 WARNING: mm/damon/core.c:217 at damon_new_region+0xf4/0x118, CPU#59: bash/341468 Call trace: damon_new_region+0xf4/0x118 (P) damon_set_regions+0xfc/0x3c0 damon_sample_mtier_build_ctx+0xe8/0x3a8 damon_sample_mtier_start+0x1c/0x90 damon_sample_mtier_enable_store+0x98/0xb0 param_attr_store+0xb4/0x128 module_attr_store+0x2c/0x50 sysfs_kf_write+0x58/0x90 kernfs_fop_write_iter+0x16c/0x238 vfs_write+0x2c0/0x370 ksys_write+0x74/0x118 __arm64_sys_write+0x24/0x38 invoke_syscall+0xa8/0x118 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x54/0x370 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 ---[ end trace 0000000000000000 ]--- Note that the same issue can happen if detect_node_addresses is true, and node 0 or 1 is memoryless. Fix it together by checking the validity of parameters right before damon_new_region() and fail early if they're invalid. The Linux kernel CVE team has assigned CVE-2026-80592 to this issue. Affected and fixed versions =========================== Issue introduced in 6.16 with commit 82a08bde3cf7bbbe90de57baa181bebf676582c7 and fixed in 6.18.40 with commit 9d360fb820a3b9576d155e720ec44fef54d2efb5 Issue introduced in 6.16 with commit 82a08bde3cf7bbbe90de57baa181bebf676582c7 and fixed in 7.1.5 with commit db20589d7b248211f63f4a7f642a49c0832b13ae Issue introduced in 6.16 with commit 82a08bde3cf7bbbe90de57baa181bebf676582c7 and fixed in 7.2 with commit 7746d72c64054976887928d64d2caf25c5a6dcc0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80592 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: samples/damon/mtier.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9d360fb820a3b9576d155e720ec44fef54d2efb5 https://git.kernel.org/stable/c/db20589d7b248211f63f4a7f642a49c0832b13ae https://git.kernel.org/stable/c/7746d72c64054976887928d64d2caf25c5a6dcc0