CVE-2026-68164: Linux Kernel Privilege Escalation Flaw

CVE-2026-68164 Overview

CVE-2026-68164 is a Linux kernel vulnerability in the Data Access MONitor (DAMON) subsystem. The flaw resides in damon_set_regions() within mm/damon/core, which assumes input ranges are sorted by address and do not overlap. Commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting") removed the validation that enforced this assumption. As a result, overlapping regions can produce weird monitoring snapshots, cause DAMOS actions to apply multiple times, and skew DAMOS quota accounting. In some sequences, negative-size regions can be produced, triggering WARN_ONCE() on kernels built with CONFIG_DAMON_DEBUG_SANITY=y and a potential divide-by-zero in damon_merge_two_regions().

Critical Impact
A negative-size DAMON region can trigger a kernel WARN_ONCE() and a divide-by-zero in damon_merge_two_regions(), leading to denial of service on affected Linux kernels.

Affected Products

Linux kernel versions containing commit 97d482f4592f in the mm/damon/sysfs code path
Kernel builds with DAMON enabled and sysfs region configuration exposed
Kernels built with CONFIG_DAMON_DEBUG_SANITY=y are additionally exposed to WARN_ONCE() conditions

Discovery Timeline

2026-08-10 - CVE-2026-68164 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68164

Vulnerability Analysis

DAMON is the Linux kernel's data access monitoring framework used to observe memory access patterns and drive DAMON-based Operation Schemes (DAMOS). The function damon_set_regions() accepts an array of address ranges and updates the monitored region set. Its correctness depends on the caller providing sorted, non-overlapping ranges.

The original implementation validated this invariant, but commit 97d482f4592f refactored the sysfs region setter to reuse damon_set_regions() and dropped the input validation in the process. Once overlapping ranges reach the region set, downstream logic behaves unpredictably.

Users with permission to write DAMON sysfs region attributes can supply crafted range inputs. Overlapping input ranges cause DAMOS to apply the same action to overlapping memory more than once and corrupt quota accounting. Region updates in a specific order can produce a region with a negative size, an invariant violation that the merge path does not tolerate.

Root Cause

The root cause is missing input validation in damon_set_regions() after the sysfs reuse refactor. The function assumes but no longer verifies that input ranges are sorted by start address and non-overlapping. The fix reinstates the check and returns an error when the invariant is violated.

Attack Vector

A local user with write access to DAMON sysfs region files can submit overlapping ranges. Depending on the update sequence, this yields inconsistent monitoring output, incorrect DAMOS behavior, a WARN_ONCE() splat, or a divide-by-zero inside damon_merge_two_regions() that results in kernel denial of service. Refer to the upstream commit e33adf96 for the corrective patch and validation logic.

Detection Methods for CVE-2026-68164

Indicators of Compromise

Kernel log entries containing WARN_ONCE originating from DAMON region management code paths
Kernel oops or panic messages referencing damon_merge_two_regions with divide-by-zero fault text
DAMON monitoring snapshots showing overlapping or negative-size regions

Detection Strategies

Audit dmesg and /var/log/kern.log for DAMON-related warnings and arithmetic exception traces
Inventory running kernels against the fixed stable versions referenced in the upstream patch series
Track writes to /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/targets/*/regions/ for anomalous range configurations

Monitoring Recommendations

Alert on repeated kernel WARN or BUG events tied to memory subsystem functions
Monitor local privilege escalation and unprivileged access to DAMON sysfs entries in multi-tenant hosts
Correlate kernel telemetry with process context to identify the user or workload triggering DAMON reconfiguration

How to Mitigate CVE-2026-68164

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits e33adf96, 06a4beee, 4b4a3e7e, 6ce0db97, and 95415767
Restrict write access to DAMON sysfs region files to trusted administrative accounts only
Reboot affected hosts after patch installation to activate the fixed kernel

Patch Information

The upstream fix restores validation in damon_set_regions() and returns an error when input ranges are unsorted or overlapping. Patches are available across stable branches. See the mainline fix Kernel Commit e33adf96 and stable backports 06a4beee, 4b4a3e7e, 6ce0db97, and 95415767.

Workarounds

Disable DAMON if the workload does not require it by unloading or not enabling the subsystem in kernel config
Tighten filesystem permissions on /sys/kernel/mm/damon/ to prevent non-root writes
Avoid building production kernels with CONFIG_DAMON_DEBUG_SANITY=y until patches are applied to reduce WARN_ONCE() exposure

bash

# Restrict DAMON sysfs write access to root only
chmod -R go-w /sys/kernel/mm/damon/

# Verify kernel version against fixed stable releases
uname -r