CVE-2026-89796 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races", v1.1.
Sashiko found a few issues in DAMON that could cause infinite loop, NULL dereference and monitoring results degradation. The first two sounds scary but the infinite loop happens only under unreasonable user setup. The NULL dereference is only in a unit test. Monitoring results degradation is trivial since it is only best-effort, and those happens from only unlikely races. Still those are bugs that better to fix if possible. Fix those.
This patch (of 6):
Due to online parameter update like events, the number of DAMON regions could be higher than the user-set upper limit. kdamond_merge_regions() repeats merge regions until the number meets the limit, while doubling the merge threshold up to the theoretical maximum threshold. It is tried only up to the theoretical maximum threshold because even the aggressive merging can fail from reducing the number of regions under the user-defined upper limit. For example, there could be many user-defined non-contiguous regions that cannot be merged.
The threshold based loop break condition is evaluated by comparing the threshold for the next merging try against the theoretical maximum threshold. If max_thres is larger than UINT_MAX / 2, doubling the threshold could make it overflow, and bypass the loop break condition. In the case, if the number of regions cannot be reduced under the upper limit like explained above, the loop will run infinitely.
Prevent the case by doing the break condition check before doubling the threshold. Also, prevent the threshold exceeding the maximum threshold, as it could overflow and apply the wrong merge threshold.
This issue is unlikely to occur in real world, since having the max_thres higher than UINT_MAX / 2 require unrealistically large aggregation intervals compared to the sampling interval. Also, it requires an unrealistically large number of uncontiguous regions setup. Nonetheless, the consequence is bad and the fix is simple.
The issue was discovered [1] by Sashiko.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel vulnerability identified in mm/damon/core addresses a critical logic error within the DAMON (Data Access MONitoring) subsystem that can lead to an infinite loop during region merging operations. This flaw arises from improper handling of integer overflow when calculating merge thresholds, specifically within the kdamond_merge_regions function. The issue was discovered by Sashiko and resolved through a patch series aimed at stabilizing the DAMON module against edge cases involving unreasonable user configurations. While the vulnerability is considered low risk in typical production environments due to its dependency on extreme parameter settings, it represents a significant flaw in input validation and arithmetic safety within kernel memory management code.
DAMON operates by monitoring virtual memory access patterns and dividing address spaces into regions for analysis. To maintain performance and manageability, DAMON enforces an upper limit on the number of active regions. When this limit is exceeded, typically due to dynamic updates or events that increase region count beyond static configuration limits, the kernel invokes kdamond_merge_regions() to consolidate adjacent areas. This function iteratively merges regions by adjusting a threshold value, which determines how aggressively nearby memory addresses are combined into single regions. The algorithm attempts to double this threshold in each iteration until either the number of regions falls below the user-defined upper limit or a theoretical maximum threshold is reached.
The core technical flaw lies in the arithmetic operation used to update the merge threshold. Specifically, the code doubles the current threshold value before checking if it has exceeded the theoretical maximum allowed value. When the current threshold exceeds UINT_MAX divided by two, doubling it results in an integer overflow that wraps around to a small positive number or zero. This underflow causes the loop break condition, which compares the new threshold against the maximum limit, to evaluate incorrectly as false. Consequently, even if further merging is impossible because remaining regions are non-contiguous and cannot be merged, the loop continues indefinitely rather than terminating gracefully.
The operational impact of this vulnerability is primarily a denial of service manifested through CPU consumption and system unresponsiveness within the affected kernel thread. Because kdamond_merge_regions runs in a context that may block other operations or consume scheduler time slices continuously, an infinite loop can degrade overall system performance. Although the scenario requires unrealistic conditions—such as aggregation intervals vastly larger than sampling intervals combined with an improbably large number of non-contiguous regions—the potential for local denial of service remains a valid security concern. The vulnerability does not typically allow privilege escalation or arbitrary code execution but compromises system stability and availability.
From a classification perspective, this issue aligns with CWE-190 Integer Overflow or Wraparound, as the failure stems from arithmetic operations exceeding the bounds of their data type without proper checks. It also relates to CWE-835 Loop with Unreachable Exit Condition, where logical errors prevent termination despite intended safeguards. In terms of ATT&CK mapping, this vulnerability facilitates Local Denial of Service (T1499), as an attacker or misconfigured application could trigger the infinite loop by manipulating DAMON parameters to force the specific overflow condition.
Mitigation strategies involve applying the upstream kernel patch that restructures the threshold update logic. The fix ensures that the break condition is evaluated before doubling the threshold, thereby preventing integer overflow from bypassing termination checks. Additionally, explicit bounds checking is implemented to ensure the threshold never exceeds its maximum allowable value during calculation. System administrators should keep their Linux kernels updated with these security fixes and review DAMON configurations to avoid setting extreme aggregation intervals relative to sampling rates. Regular auditing of kernel parameter settings can further reduce the likelihood of encountering this edge case in production environments.