CVE-2026-52905: Linux Kernel DAMON Region Vulnerability

CVE-2026-52905 Overview

CVE-2026-52905 is a Linux kernel vulnerability in the Data Access MONitor (DAMON) subsystem. The flaw resides in mm/damon/core and allows the DAMON sysfs interface to emit a non-power-of-two min_region_sz value through damon_start(). This results in unaligned DAMON region address ranges, which violates an invariant the kernel relies on for memory access monitoring. The defect was originally introduced by commit d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region"). A prior fix in commit c80f46ac228b addressed the damon_commit_ctx() path but left damon_start() exposed. The vulnerability has been resolved upstream by adding an is_power_of_2() check on damon_start().

Critical Impact

Unaligned DAMON region address ranges in the Linux kernel memory access monitoring subsystem can lead to undefined behavior when invalid min_region_sz values are submitted via the sysfs interface.

Affected Products

• Linux kernel versions containing commit d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region")
• Linux kernel builds with DAMON enabled (CONFIG_DAMON) and the DAMON sysfs interface (CONFIG_DAMON_SYSFS)
• Stable kernel branches prior to the fix commits 1de2db1, 89b6226, and 95093e5

Discovery Timeline

• The issue was discovered by the reporter referenced as sashiko in the upstream commit message
• 2026-06-09 - CVE-2026-52905 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-52905

Vulnerability Analysis

DAMON (Data Access MONitor) is a Linux kernel subsystem that tracks memory access patterns at the granularity of contiguous virtual or physical address regions. Each region must be aligned to min_region_sz, and the kernel assumes this value is a power of two so alignment arithmetic can rely on bitmask operations. When a non-power-of-two value is accepted, region boundaries become unaligned. This breaks downstream assumptions in region splitting, merging, and access-bit sampling logic. Commit c80f46ac228b added an is_power_of_2() check on the damon_commit_ctx() path, but the parallel entry point damon_start() invoked from the DAMON sysfs interface remained unguarded. A local user with permission to write the DAMON sysfs attributes could therefore start a monitoring context with an arbitrary min_region_sz, propagating an invalid value into the core monitoring loop.

Root Cause

The root cause is an incomplete input validation fix. The original defect introduced in d8f867fa0825 did not constrain min_sz_region to a power of two. The follow-up fix in c80f46ac228b added the validation only in damon_commit_ctx(), leaving damon_start() as a second, equally reachable path that could install an invalid value into the active DAMON context.

Attack Vector

Exploitation requires local access with sufficient privileges to write to the DAMON sysfs interface, typically under /sys/kernel/mm/damon/. An attacker writes a non-power-of-two value to the min_region_sz attribute and then triggers damon_start() to activate monitoring. The kernel propagates the unaligned value into region tracking structures, producing undefined behavior in the DAMON core. No remote attack vector exists for this defect.

The vulnerability is described in prose because no public exploit code has been released. Technical details are available in the upstream fix commits referenced in the Kernel Git Commit 1de2db1, Kernel Git Commit 89b6226, and Kernel Git Commit 95093e5.

Detection Methods for CVE-2026-52905

Indicators of Compromise

• Writes to /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/monitoring_attrs/min_nr_regions or related DAMON sysfs attributes with non-power-of-two values.
• Kernel log messages or warnings originating from mm/damon/core after a DAMON monitoring context is started.
• Unexpected DAMON kdamond kernel threads (kdamond.*) started by non-administrative user sessions.

Detection Strategies

• Audit kernel.uname -r output across the fleet and compare against vendor kernel changelogs that include the fix commits 1de2db1, 89b6226, and 95093e5.
• Enable auditd rules on /sys/kernel/mm/damon/ to record write operations and the originating UID and process.
• Monitor for processes invoking write() against DAMON sysfs paths followed by activation of a kdamond thread.

Monitoring Recommendations

• Centralize kernel logs and audit events from Linux hosts into a SIEM for correlation of DAMON sysfs writes with privilege context.
• Track kernel package versions through configuration management and flag hosts running pre-patch kernels with DAMON enabled.
• Alert on any non-root write to DAMON sysfs attributes, since legitimate use is typically limited to administrators or memory tuning agents.

How to Mitigate CVE-2026-52905

Immediate Actions Required

• Update affected Linux hosts to a kernel build that includes commits 1de2db1, 89b6226, or 95093e5 on the relevant stable branch.
• Restrict write access to /sys/kernel/mm/damon/ to root and trusted system services until patching is complete.
• Inventory systems with CONFIG_DAMON and CONFIG_DAMON_SYSFS enabled to prioritize remediation.

Patch Information

The upstream fix adds an is_power_of_2() check to damon_start() so that the DAMON sysfs interface can no longer activate a context with a non-power-of-two min_region_sz. The relevant commits are Kernel Git Commit 1de2db1, Kernel Git Commit 89b6226, and Kernel Git Commit 95093e5. Apply the vendor kernel update that incorporates these patches for your distribution.

Workarounds

• Disable DAMON at runtime if it is not required by unloading or not loading the DAMON modules and ensuring CONFIG_DAMON_SYSFS consumers are not active.
• Apply mandatory access control policies (SELinux, AppArmor) to deny write access to /sys/kernel/mm/damon/ for non-administrative users.
• Rebuild the kernel without CONFIG_DAMON_SYSFS if DAMON monitoring via sysfs is not used in the deployment.

# Restrict DAMON sysfs writes to root only until patching is complete
chmod -R go-w /sys/kernel/mm/damon/ 2>/dev/null

# Verify running kernel version against fixed commits
uname -r

# Check whether DAMON sysfs is exposed
ls /sys/kernel/mm/damon/ 2>/dev/null && echo "DAMON sysfs present"