CVE-2026-46020: Linux Kernel Privilege Escalation Flaw

CVE-2026-46020 Overview

CVE-2026-46020 is a Linux kernel vulnerability in the Data Access Monitor (DAMON) subsystem. The flaw resides in mm/damon/core where damos_quota_goal->nid is passed to si_meminfo_node() and NODE_DATA() without validation. Privileged users can supply an arbitrary node identifier through DAMON_SYSFS, triggering an out-of-bounds memory access in the kernel.

The issue is reproducible using the user-space damo tool by configuring a node_mem_used_bp quota goal with an invalid node id, producing a NULL pointer dereference at kernel address 0x0000000000000098.

Critical Impact
Local privileged users can trigger an out-of-bounds kernel memory access leading to kernel crash or potential memory disclosure through the DAMON sysfs interface.

Affected Products

Linux kernel versions including the node_mem_{used,free}_bp DAMOS quota goal feature in mm/damon/core
Distributions shipping unpatched mainline and stable kernels that expose DAMON_SYSFS
Systems where privileged user-space tools such as damo interact with DAMON

Discovery Timeline

2026-05-27 - CVE-2026-46020 published to the National Vulnerability Database
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46020

Vulnerability Analysis

DAMON (Data Access MONitor) is a Linux kernel subsystem that observes memory access patterns. The DAMOS (DAMON-based Operation Schemes) component supports quota goals that throttle actions based on node-level memory pressure. Two such goals, node_mem_used_bp and node_mem_free_bp, accept a NUMA node identifier supplied through the sysfs interface.

The kernel forwards this user-controlled nid directly to si_meminfo_node() and the NODE_DATA() macro. Neither call validates that the node id falls within the range of online or possible nodes. When a privileged caller supplies an out-of-range value such as -1, the kernel dereferences memory outside the node_data array, producing a NULL pointer dereference or arbitrary out-of-bounds read.

Root Cause

The root cause is missing input validation [CWE-20] on a user-supplied identifier used as an array index. The DAMOS quota goal accepts arbitrary signed integer values from sysfs but treats them as valid NUMA node indices without bounds checking against nr_node_ids or node_online().

Attack Vector

Exploitation requires local access with privileges sufficient to write to DAMON_SYSFS, typically CAP_SYS_ADMIN. An attacker creates a DAMON scheme through sysfs, attaches a quota goal of type node_mem_used_bp or node_mem_free_bp, and sets the nid attribute to an invalid value. When the DAMON kernel thread evaluates the quota goal, it dereferences memory based on the attacker-controlled index, crashing the kernel or accessing unintended memory regions.

Reproduction with the damo tool uses commands of the form damo start --damos_action stat --damos_quota_goal node_mem_used_bp 50% -1 --damos_quota_interval 1s, which results in Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 in dmesg.

Detection Methods for CVE-2026-46020

Indicators of Compromise

Kernel oops or panic messages referencing si_meminfo_node, NODE_DATA, or DAMON call frames in dmesg or /var/log/kern.log
Unexpected writes to /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/schemes/*/quotas/goals/*/nid with negative or out-of-range values
Execution of the damo user-space tool or direct sysfs interaction with DAMON quota goals by non-administrative workloads

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereference signatures originating from mm/damon/core.c
Audit process executions invoking damo or scripts writing to DAMON sysfs paths under /sys/kernel/mm/damon
Track usage of CAP_SYS_ADMIN operations against the DAMON sysfs hierarchy using Linux audit rules

Monitoring Recommendations

Enable auditd watches on /sys/kernel/mm/damon to record write events and the responsible process
Forward kernel logs to a centralized analytics platform and alert on oops or panic strings tied to DAMON symbols
Inventory hosts that have DAMON sysfs enabled in their kernel configuration (CONFIG_DAMON_SYSFS=y) and confirm whether it is required

How to Mitigate CVE-2026-46020

Immediate Actions Required

Apply the upstream kernel patches that add node id validation to DAMOS quota goals before exposing DAMON sysfs to operators
Restrict CAP_SYS_ADMIN and write access on /sys/kernel/mm/damon to trusted administrative accounts only
If DAMON is not used operationally, disable CONFIG_DAMON_SYSFS or unmount the DAMON sysfs interface

Patch Information

The fix validates the supplied node id and, when invalid, returns 0% for the used-memory ratio and 100% for the free-memory ratio rather than dereferencing kernel memory. The patches are available in the stable kernel tree:

Workarounds

Remove write permissions on DAMON sysfs entries for non-root principals using filesystem ACLs or namespaced mounts
Block execution of the damo user-space tool via application allowlisting on production systems
Use a Linux Security Module policy (SELinux or AppArmor) to deny writes to /sys/kernel/mm/damon/* from unprivileged service accounts

bash

# Configuration example: deny non-root writes to DAMON sysfs and verify patch level
uname -r
ls -l /sys/kernel/mm/damon/admin/kdamonds 2>/dev/null
chmod -R o-w /sys/kernel/mm/damon 2>/dev/null
auditctl -w /sys/kernel/mm/damon -p wa -k damon_sysfs_write