Linux Kernel up to 7.1.8 Damon Lru Sort mm/damon/lru_sort.c damos_quota_score active_mem_bp divide by zero

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.1.8. It has been classified as problematic. Affected by this vulnerability is the function damos_quota_score of the file mm/damon/lru_sort.c of the component Damon Lru Sort. The manipulation of the argument active_mem_bp leads to divide by zero. This vulnerability is uniquely identified as CVE-2026-74645. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 7.1.8. This issue affects the function damos_quota_score of the file mm/damon/lru_sort.c of the component Damon Lru Sort. The manipulation of the argument active_mem_bp with an unknown input leads to a divide by zero vulnerability. Using CWE to declare the problem leads to CWE-369. The product divides a value by zero. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: error out for >10000 active_mem_bp damos_quota_score() can trigger division by zero if the target value is zero. DAMON_LRU_SORT lets users set the target value for the hot memory scheme via active_mem_bp parameter. It avoids setting it as the target value if the parameter value is zero. However, it also sets the cold memory scheme with a target value that is calculated as '10000 - active_mem_bp + 2'. Hence, if a user sets active_mem_bp 10002, the cold memory scheme's quota goal target value can be zero. As a result, division by zero can be triggered. Fix by returning an error when the user tries to start DAMON with >10000 active_mem_bp parameter value. It makes no sense to set active_mem_bp with 10002. It also requires module parameters write permission to reproduce the issue. That said, the consequence is quite bad. One reliable way to reproduce the issue is like below: # cd /sys/module/damon_lru_sort/parameters # echo 1000 > wmarks_high # echo 995 > wmarks_mid # echo 0 > wmarks_low # echo 10002 > active_mem_bp # echo Y > enabled # dmesg -w [...] [ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI [ 597.428848] RIP: 0010:damos_quota_score+0x6f/0x480 This issue was discovered [1] by Sashiko.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-74645 since 08/15/2026. The exploitation is known to be easy. Attacking locally is a requirement. Additional levels of successful authentication are required for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 7.1.9 eliminates this vulnerability. Applying the patch e7e5e5e0dfe2ea171044c24c263efae4ee882b3f is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion