CVE-2026-64458: Linux Kernel Privilege Escalation Flaw

CVE-2026-64458 Overview

CVE-2026-64458 is a Linux kernel vulnerability in the Data Access MONitor (DAMON) subsystem. The flaw resides in the damon_hot_score() function within mm/damon/ops-common. It stems from improper handling of extreme monitoring intervals supplied through the DAMON sysfs interface. A local user with write access to /sys/kernel/mm/damon/admin/ can trigger a divide-by-zero error or an out-of-bounds array access. Both conditions result in a kernel oops and denial of service. The issue was discovered by Sashiko and resolved through six upstream stable-tree commits.

Critical Impact
A local user with DAMON sysfs write permission can crash the kernel by setting sampling or aggregation intervals to zero, or by supplying very high aggregation intervals that cause out-of-bounds array indexing.

Affected Products

Linux kernel versions containing the DAMON mm/damon/ops-common implementation of damon_hot_score()
Distributions shipping kernels with DAMON enabled (CONFIG_DAMON) and exposing the DAMON sysfs interface
Systems where non-root users have been granted write access to /sys/kernel/mm/damon/admin/

Discovery Timeline

2026-07-25 - CVE-2026-64458 published to the National Vulnerability Database
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64458

Vulnerability Analysis

The vulnerability affects the DAMON subsystem, which provides data access monitoring for Linux memory management. Three distinct issues exist in damon_hot_score() due to improper validation of user-supplied monitoring intervals.

First, when the sampling interval is set to zero, the damon_max_nr_accesses() helper performs a division using the interval as a denominator. This produces a divide-by-zero kernel exception. Second, when the aggregation interval is set to zero, damon_max_nr_accesses() returns zero. The caller damon_hot_score() then uses this return value as a denominator, triggering another divide-by-zero. Third, when the aggregation interval is set to a very high value, damon_hot_score() can return a value outside the [0, DAMOS_MAX_SCORE] range. Because this return value indexes the regions_score_histogram array of size DAMOS_MAX_SCORE+1, an out-of-bounds access follows.

Root Cause

The root cause is missing input validation in damon_max_nr_accesses() and missing bounds enforcement in damon_hot_score(). Neither function checks for zero or excessively large interval values before performing arithmetic that assumes bounded inputs. The upstream patches explicitly handle zero intervals in damon_max_nr_accesses() and clamp the return value of damon_hot_score() to the [0, DAMOS_MAX_SCORE] range.

Attack Vector

Exploitation requires local access and write permission to the DAMON sysfs administrative interface. A user writes 0 to contexts/0/monitoring_attrs/intervals/sample_us and contexts/0/monitoring_attrs/intervals/aggr_us, then commits the change by writing commit to state. The resulting kernel oops (divide error: 0000 [#1] SMP NOPTI at damon_hot_score+0x27/0xd0) crashes the DAMON kernel thread and can destabilize the system.

Detection Methods for CVE-2026-64458

Indicators of Compromise

Kernel log entries containing Oops: divide error with RIP: 0010:damon_hot_score in the crash frame
Unexpected termination of kdamond kernel worker threads
Writes of 0 to sample_us or aggr_us under /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/monitoring_attrs/intervals/

Detection Strategies

Monitor dmesg and journald for kernel oops events referencing DAMON symbols
Audit write access to the /sys/kernel/mm/damon/ hierarchy using Linux Audit rules on file paths beginning with /sys/kernel/mm/damon/admin/
Correlate DAMON configuration writes from non-root or unexpected user contexts against baseline administrative activity

Monitoring Recommendations

Enable kernel.panic_on_oops in test environments to surface crash regressions early during patch validation
Ingest kernel logs into a centralized SIEM and alert on divide error and damon_hot_score string matches
Track kdamond process lifecycle to identify abnormal restarts or terminations

How to Mitigate CVE-2026-64458

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the fix commits and rebuild affected kernels
Restrict write access to /sys/kernel/mm/damon/admin/ to trusted administrative accounts only
Disable the DAMON subsystem in kernel configuration where the feature is not required

Patch Information

The fix is available in the upstream Linux stable tree through commits 35d4a3c, 58321b4, 74fef68, 76e415e, 9c8f31e, and ef2ae10. The patches explicitly handle zero intervals in damon_max_nr_accesses() and clamp the return value of damon_hot_score() to the valid [0, DAMOS_MAX_SCORE] range.

Workarounds

Ensure the DAMON sysfs interface is only writable by root; verify permissions on /sys/kernel/mm/damon/admin/ after boot
Avoid granting CAP_SYS_ADMIN or DAMON sysfs write capability to unprivileged service accounts
If DAMON is not in use, unload or disable the module and rebuild with CONFIG_DAMON disabled

bash

# Verify DAMON sysfs permissions are restricted to root
ls -l /sys/kernel/mm/damon/admin/kdamonds/0/contexts/0/monitoring_attrs/intervals/

# Confirm current kernel version reflects a patched build
uname -r