Linux Kernel up to 6.18.29/7.0.3 mm /damon/core damon_start min_sz_region privilege escalation

Summaryinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.29/7.0.3. Affected by this vulnerability is the function damon_start of the file /damon/core of the component mm. The manipulation of the argument min_sz_region leads to an unknown weakness. This vulnerability is referenced as CVE-2026-52905. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.29/7.0.3 and classified as critical. This issue affects the function damon_start of the file /damon/core of the component mm. The manipulation of the argument min_sz_region with an unknown input leads to a unknown weakness. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow non-power of two min_region_sz on damon_start() Commit d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") introduced a bug that allows unaligned DAMON region address ranges. Commit c80f46ac228b ("mm/damon/core: disallow non-power of two min_region_sz") fixed it, but only for damon_commit_ctx() use case. Still, DAMON sysfs interface can emit non-power of two min_region_sz via damon_start(). Fix the path by adding the is_power_of_2() check on damon_start(). The issue was discovered by sashiko [1].

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-52905 since 06/09/2026. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/09/2026).

Upgrading to version 6.18.30, 7.0.4 or 7.1-rc1 eliminates this vulnerability. Applying the patch 1de2db19a6028abe7d905875922faef5b873de67/89b6226b6c2a4add3939f361653a47c212d6ab75/95093e5cb4c5b50a5b1a4b79f2942b62744bd66a is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.18.20
• 6.18.21
• 6.18.22
• 6.18.23
• 6.18.24
• 6.18.25
• 6.18.26
• 6.18.27
• 6.18.28
• 6.18.29
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion