Linux Kernel up to 7.2.4 Damon mm/damon/core.c damon_apply_min_nr_regions null pointer dereference

Summaryinfo

A vulnerability has been found in Linux Kernel up to 7.2.4 and classified as very critical. Affected by this vulnerability is the function damon_apply_min_nr_regions of the file mm/damon/core.c of the component Damon. The manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2026-90004. An attack has to be approached locally. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.4 and classified as very critical. This issue affects the function damon_apply_min_nr_regions of the file mm/damon/core.c of the component Damon. The manipulation with an unknown input leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: handle region split failure in apply_min_nr_regions() damon_apply_min_nr_regions() repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes the split operation (damon_split_region_at()) will always succeed and create the new region. But the operation could silently fail for memory allocation failures, for example. If such failure happens and the region was the last region, the linked list-based next region fetching returns invalid pointer. As a result, invalid memory dereference and corruption could happen. Even if the corner case is handled, it imposes stress to the allocator by trying split regions for other targets. Fix the issue by breaking all the loops for any region split failure. This means there could be a min_nr_regions violation. It will only rarely happen since the allocation is arguably too small to fail. Even if it happens, it is only temporal. damon_apply_min_nr_regions() will be called again after the aggregation interval. The user impact of the issue should be minor, since the allocation is arguably too small to fail. But, it could still theoretically happen, and the consequence is very bad. This issue was discovered [1] by Sashiko.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-90004 since 09/11/2026. The exploitation is known to be easy. Attacking locally is a requirement. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/16/2026).

Upgrading to version 7.2.5 or 7.3-rc1 eliminates this vulnerability. Applying the patch 463ebd63e8ee3d73022a18915ea43320dad8aad7/c608748607620f331196ed0ba9fe4017892c1457 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion