CVE-2026-68165: Linux Kernel DAMON DoS Vulnerability

CVE-2026-68165 Overview

CVE-2026-68165 is a Linux kernel vulnerability in the Data Access MONitor (DAMON) subsystem. The flaw resides in mm/damon/core.c where damon_set_regions() did not validate region ranges supplied by userspace callers. DAMON API paths including DAMON_SYSFS, DAMON_RECLAIM, and DAMON_LRU_SORT allow users to configure empty monitoring target regions with identical start and end offsets. DAMON core logic assumes zero-length regions cannot exist. When such a region is committed, the kernel triggers a WARN_ONCE() on builds with CONFIG_DAMON_DEBUG_SANITY=y and can execute a divide-by-zero in damon_merge_two_regions(). The upstream fix adds range validation to damon_set_regions().

Critical Impact
A local user with access to the DAMON sysfs interface can trigger a kernel warning or divide-by-zero condition, producing denial of service on affected Linux kernels.

Affected Products

Linux kernel builds exposing the DAMON subsystem through sysfs
Kernels with DAMON_RECLAIM enabled
Kernels with DAMON_LRU_SORT enabled

Discovery Timeline

2026-08-10 - CVE-2026-68165 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68165

Vulnerability Analysis

DAMON is the Linux kernel data access monitoring framework used to build memory management schemes such as proactive reclamation and LRU sorting. The subsystem represents monitored memory as ordered regions with start and end addresses. Internal routines including damon_new_region() and damon_merge_two_regions() assume every region has non-zero length. The damon_set_regions() helper accepted user-provided ranges without enforcing that assumption. A local user with write access to /sys/kernel/mm/damon/admin/ can commit a target region where start == end. On kernels compiled with CONFIG_DAMON_DEBUG_SANITY=y, this raises a WARN_ONCE() at mm/damon/core.c:359 inside damon_new_region+0x6e/0x80. In merge paths, zero-length regions cause a divide-by-zero that produces a kernel oops.

Root Cause

The root cause is missing input validation in damon_set_regions(). All DAMON API callers funnel region configuration through this single function, so the absence of a range check propagates invalid state throughout the DAMON core. The patch adds explicit validation so that ranges with start >= end are rejected before any region object is constructed.

Attack Vector

Exploitation requires local access and permission to write to the DAMON sysfs interface, which is typically restricted to root or privileged administrative processes. Reproduction consists of writing identical values to a target region's start and end files under /sys/kernel/mm/damon/admin/kdamonds/0/contexts/0/targets/0/regions/0/, then writing commit to the state file. The trigger surfaces the WARN in damon_new_region() and, on merge, a divide-by-zero panic. The vulnerability is described in prose because no verified proof-of-concept code is published beyond the reproduction steps in the upstream commit message.

Detection Methods for CVE-2026-68165

Indicators of Compromise

Kernel log entries containing start 0 >= end 0 or WARNING: mm/damon/core.c from damon_new_region
Divide error oops referencing damon_merge_two_regions
Unexpected writes to /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/targets/*/regions/*/ from non-administrative processes

Detection Strategies

Monitor dmesg and /var/log/kern.log for DAMON WARN traces and divide-error oops signatures.
Audit process activity that opens or writes to files under the DAMON sysfs hierarchy.
Correlate kernel warnings against the running kernel version to determine whether the fix commits are present.

Monitoring Recommendations

Forward kernel logs into a centralized SIEM and alert on DAMON-specific warning strings.
Track kernel package versions across the fleet and flag hosts running unpatched builds that expose DAMON sysfs.
Include DAMON sysfs paths in file integrity monitoring for servers where the subsystem is not expected to be reconfigured at runtime.

How to Mitigate CVE-2026-68165

Immediate Actions Required

Apply the upstream stable kernel updates that include the damon_set_regions() validation fix.
Restrict write access to /sys/kernel/mm/damon/ to trusted administrative accounts and services.
Where DAMON is not required, disable DAMON_SYSFS, DAMON_RECLAIM, and DAMON_LRU_SORT in the kernel configuration.

Patch Information

The fix is available in the mainline and stable trees. Refer to the upstream commits: Kernel Git Commit Change, Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Commit Review, and Kernel Git Commit Patch. Rebuild or install a distribution kernel package containing these commits.

Workarounds

Unmount or restrict permissions on the DAMON sysfs directory until the kernel is patched.
Remove CAP_SYS_ADMIN from workloads that do not require kernel tuning to reduce reach to DAMON interfaces.
Disable the DAMON user-facing modules at boot time on systems where memory tuning is not needed.

bash

# Restrict access to the DAMON sysfs administrative interface
chmod 700 /sys/kernel/mm/damon/admin

# Verify running kernel includes the fix commit
strings /boot/vmlinuz-$(uname -r) | grep -i "damon_set_regions"

# Optionally disable DAMON modules where not required
echo "blacklist damon_reclaim" >> /etc/modprobe.d/damon.conf
echo "blacklist damon_lru_sort" >> /etc/modprobe.d/damon.conf