CVE-2026-99240 in Linux
Summary
by MITRE • 11/02/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: error damos_commit_quota_goal() for zero target_value
Patch series "mm/damon: move zero damos quota target_value handling to the core layer".
Having zero DAMOS quota target value can cause division by zero. DAMON API callers are checking the target value parameters to avoid that. It is easy to make mistakes in some of the multiple API callers. Move that to the core layer.
Patch 1 adds the corner case handling into the core layer DAMON parameters validation logic. Patches 2 and 3 remove no more needed DAMON API callers side handling of the corner case in DAMON_LRU_SORT and DMON_SAMPLIE_MTIER, respectively.
This patch (of 3):
If a DAMOS scheme has a damos_quota_goal of zero target_value, damos_quota_goal() could trigger division-by-zero error. Hence each DAMON API callers should do the zero target_value validation. It is easy to make mistakes. Actually such bugs in DAMON_LRU_SORT and DAMON_SAMPLE_MTIER were found and fixed [1].
It is better to handle the corner case only once in the core layer, instead of multiple places in all DAMON API callers. One straightforward option is using an alternative denominator for the corner case in the damos_quota_goal(). However, the zero target_value is meaningless. In this case, the quota goal is always evaluated as achieved or over-achieved. The quota will only keep being reduced.
Simply avoid using zero target_value by adding a check in the core layer DAMOS quota goal parameters validation/commit path, damos_commit_quota_goal(). Update it to return an error in the case. Also update its caller to propagate the error.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The Linux kernel vulnerability identified involves a potential division-by-zero error within the Data Access Monitoring (DAMON) subsystem, specifically affecting the DAMOS quota goal management logic. This issue resides in the mm/damon/core module and is triggered when an application or system component attempts to commit a DAMOS scheme configuration where the target_value for the damos_quota_goal is set to zero. The core function responsible for this operation, damos_commit_quota_goal(), performs calculations that involve dividing by this target value. When the denominator is zero, it results in a critical arithmetic exception, leading to kernel instability or a system crash. This type of flaw represents a significant reliability risk because it allows local users with appropriate privileges to disrupt service availability through simple configuration errors or malicious input.
The root cause of this vulnerability lies in the architectural design where validation logic was previously distributed across multiple DAMON API callers rather than centralized. Historically, individual components such as DAMOS_LRU_SORT and DAMOS_SAMPLE_MTIER were responsible for checking whether the target value was zero before proceeding with quota operations. This decentralized approach created a high risk of oversight, as developers might inadvertently omit these checks in new or existing code paths. The vulnerability manifests when any caller fails to perform this specific validation, allowing a zero value to propagate into the core calculation routine. This is classified under CWE-369, which denotes divide-by-zero errors, and aligns with ATT&CK technique T1499, specifically related to endpoint denial of service via resource exhaustion or system instability caused by improper input handling.
The operational impact of this vulnerability extends beyond simple application crashes. Because the DAMON subsystem is integral to memory management optimization and performance monitoring within the Linux kernel, a crash in this area can lead to broader system unresponsiveness. An attacker exploiting this flaw could cause a denial-of-service condition that affects not only their own processes but potentially other critical services running on the same host. The lack of robust input validation at the core layer means that any software interacting with DAMON quotas must be meticulously audited for correctness, which is prone to human error given the complexity of kernel memory management APIs.
To mitigate this vulnerability, the Linux kernel maintainers have implemented a patch series that centralizes the validation logic within the core layer. The fix modifies the damos_commit_quota_goal() function to explicitly check if the target_value is zero during the parameter commit phase. Instead of attempting arithmetic operations with an invalid denominator or using alternative denominators which might mask logical errors, the updated code returns an error immediately when a zero value is detected. This approach ensures that invalid configurations are rejected at the earliest possible stage in the API call chain. Callers of this function have also been updated to properly propagate these errors back to user space, providing clear feedback rather than allowing silent failures or crashes.
This remediation strategy reinforces the principle of defense-in-depth by enforcing strict input validation at the boundary between user-space configurations and kernel-space execution logic. By moving the check into the core DAMON parameters validation path, the risk is eliminated for all current and future API consumers without requiring individual updates to each caller module. This change aligns with industry best practices for secure coding in operating system kernels, emphasizing centralized error handling over distributed checks. It prevents division-by-zero exceptions by ensuring that nonsensical values like a zero target value are rejected before they can trigger arithmetic faults. The fix effectively neutralizes the attack vector by making it impossible to commit a quota goal configuration with a zero denominator, thereby maintaining kernel stability and preventing potential denial-of-service scenarios arising from this specific input flaw.