CVE-2026-90004 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: handle region split failure in apply_min_nr_regions()
damon_apply_min_nr_regions() repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes the split operation (damon_split_region_at()) will always succeed and create the new region. But the operation could silently fail for memory allocation failures, for example.
If such failure happens and the region was the last region, the linked list-based next region fetching returns invalid pointer. As a result, invalid memory dereference and corruption could happen. Even if the corner case is handled, it imposes stress to the allocator by trying split regions for other targets. Fix the issue by breaking all the loops for any region split failure.
This means there could be a min_nr_regions violation. It will only rarely happen since the allocation is arguably too small to fail. Even if it happens, it is only temporal. damon_apply_min_nr_regions() will be called again after the aggregation interval.
The user impact of the issue should be minor, since the allocation is arguably too small to fail. But, it could still theoretically happen, and the consequence is very bad.
This issue was discovered [1] by Sashiko.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability resides within the Dynamic Analysis on Memory (DAMON) subsystem of the Linux kernel, specifically in the core memory management module responsible for regulating region granularity. DAMON is a framework designed to monitor and analyze memory access patterns without requiring instrumentation or recompilation of target applications. A critical component of this system is the function damon_apply_min_nr_regions(), which ensures that the number of monitored regions does not fall below a user-defined minimum threshold by recursively splitting larger regions into smaller ones. The underlying logic assumes that every call to the region split operation, damon_split_region_at(), will successfully allocate memory and create new data structures. However, this assumption is flawed because kernel memory allocation can fail due to resource exhaustion or fragmentation, leading to silent failures where the function returns an error code without creating the expected regions.
When a split operation fails, particularly if it occurs on the last region in a linked list traversal, the subsequent logic attempts to fetch the next region using standard pointer arithmetic based on the assumption that the new node exists. Since the allocation failed, this results in dereferencing an invalid or null pointer. This memory corruption can lead to kernel panics, system instability, or potentially allow for arbitrary code execution if an attacker can influence the state of memory allocators and trigger these conditions at precise moments. Although the likelihood is considered low because the individual allocations are typically small, the severity of a successful exploitation makes it a critical issue from a security perspective. The vulnerability represents a classic case of improper error handling where failure paths do not lead to safe termination or recovery but instead continue execution with corrupted state.
From an industry standard classification standpoint, this flaw aligns closely with CWE-252, which covers unchecked return values, and CWE-401, which describes missing release of memory after successful allocation. The lack of validation for the success of damon_split_region_at() allows the system to proceed under false premises about data structure integrity. In terms of attack vectors, this could be leveraged in a Denial of Service (DoS) scenario by exhausting kernel memory to force allocation failures during DAMON operations, or potentially escalated if the corrupted pointer leads to control flow hijacking. The ATT&CK framework would categorize aspects of this under T1499, Endpoint Denial of Service, as the primary impact is system instability rather than data exfiltration, though the underlying mechanism involves memory corruption techniques often associated with privilege escalation attempts.
The operational impact is characterized by a trade-off between strict policy enforcement and system stability. The fix prioritizes stability over compliance with the min_nr_regions constraint. By breaking all loops upon any split failure, the kernel ensures that it does not dereference invalid pointers or impose excessive stress on the memory allocator through repeated failed attempts to meet an arbitrary threshold. This means that in rare cases where allocation fails, the system will temporarily violate the minimum region count policy but will remain stable and secure. The DAMON subsystem is designed with periodic aggregation intervals, meaning that damon_apply_min_regions() is called again after a set duration. Consequently, any violation of the minimum region limit is transient, as subsequent calls are likely to succeed once memory pressure subsides or resources become available.
Mitigation strategies for this vulnerability involve applying the specific kernel patch that introduces proper error checking and loop termination logic within damon_apply_min_regions(). Administrators should ensure their systems are updated with the latest stable Linux kernel versions where this fix is included. For environments running older kernels, monitoring system logs for out-of-memory conditions or DAMON-related errors can provide early warning signs of potential instability. Additionally, tuning memory limits and ensuring adequate swap space can reduce the probability of allocation failures triggering this code path. Since the vulnerability relies on specific timing and resource exhaustion to manifest effectively, maintaining robust memory management practices across the host system serves as a secondary layer of defense against exploitation attempts targeting kernel subsystems with similar architectural assumptions.