CVE-2026-74643: Linux Kernel Division by Zero DoS Vulnerability

CVE-2026-74643 Overview

CVE-2026-74643 is a division-by-zero vulnerability in the Linux kernel's Data Access MONitor (DAMON) subsystem. The flaw resides in the damos_quota_score() function used by the DAMON_SAMPLE_MTIER sample module. When a user sets the node0_mem_used_bp or node0_mem_free_bp module parameter to zero, the function performs a division using that value as the divisor. The kernel raises a divide error exception, producing an oops in damos_quota_score+0x6f/0x480. The issue was discovered by Sashiko and has been resolved upstream with parameter validation that rejects zero target values before DAMON is enabled.

Critical Impact
A local user with permission to write DAMON sample module parameters can trigger a kernel oops, causing denial of service on the affected node.

Affected Products

Linux kernel builds with CONFIG_DAMON_SAMPLE_MTIER enabled
Linux kernel builds with DAMON_LRU_SORT enabled
Linux kernel mm/damon subsystem prior to the fix commits

Discovery Timeline

2026-08-22 - CVE-2026-74643 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74643

Vulnerability Analysis

The vulnerability affects DAMON, the kernel's data access monitoring framework used for memory tiering and page reclamation decisions. The DAMON_SAMPLE_MTIER module exposes tunables under /sys/module/damon_sample_mtier/parameters/ that let users configure memory-tier thresholds. Two of these parameters, node0_mem_used_bp and node0_mem_free_bp, feed into the quota scoring logic in damos_quota_score(). When the value is zero, the function divides by that value directly without any guard, generating a CPU divide-by-zero exception and an unrecoverable oops.

Root Cause

The root cause is missing input validation on module parameters passed from user space. The parameter setter accepted zero even though damos_quota_score() uses the value as a divisor. This is an input validation error rather than a memory safety flaw, but it manifests as a kernel-level fault because the divisor is consumed in kernel context.

Attack Vector

Exploitation requires local access with the ability to write to the damon_sample_mtier sysfs parameter files, which typically means root or CAP_SYS_ADMIN. A reproducer sets node0_start_addr, node0_end_addr, node1_start_addr, and node1_end_addr, then writes 0 to node0_mem_free_bp and enables the module. The next invocation of damos_quota_score() triggers Oops: divide error: 0000 [#1] SMP NOPTI at RIP: 0010:damos_quota_score+0x6f/0x480. The consequence is a denial of service on the running kernel; remote or unprivileged exploitation is not indicated by the available data.

Detection Methods for CVE-2026-74643

Indicators of Compromise

Kernel log entries containing Oops: divide error with a call trace referencing damos_quota_score
Unexpected writes to /sys/module/damon_sample_mtier/parameters/node0_mem_free_bp or node0_mem_used_bp with a value of 0
Sudden termination or hang of DAMON-related kernel threads on memory-tiered systems

Detection Strategies

Monitor dmesg and /var/log/kern.log for divide-error oopses referencing the DAMON subsystem
Audit sysfs writes under /sys/module/damon_sample_mtier/parameters/ using auditd file watches
Track kernel version and DAMON configuration (CONFIG_DAMON_SAMPLE_MTIER, CONFIG_DAMON_LRU_SORT) across the fleet to identify vulnerable builds

Monitoring Recommendations

Alert on any kernel oops or panic event ingested by host telemetry pipelines
Correlate sysfs parameter writes with subsequent kernel faults on the same host
Track unexpected reboots on systems that use DAMON for memory tiering workloads

How to Mitigate CVE-2026-74643

Immediate Actions Required

Apply the upstream kernel fix that rejects zero values for node0_mem_used_bp and node0_mem_free_bp before enabling DAMON
Disable the damon_sample_mtier module on production systems that do not require it
Restrict write access to /sys/module/damon_sample_mtier/parameters/ to trusted administrators only

Patch Information

The fix is delivered in the mainline and stable kernel trees via commits 684f271210be, a16fd3ad9d89, and e16b8d640ec9. The patch series adds parameter validation so that damos_quota_score() cannot be reached with a zero target value. Rebuild affected kernels or install a distribution kernel package that includes the backport.

Workarounds

Unload or blacklist the damon_sample_mtier kernel module where it is not required
Rebuild the kernel without CONFIG_DAMON_SAMPLE_MTIER for hardened production images
Enforce strict file permissions on DAMON sysfs parameter files to prevent accidental zero-value writes

bash

# Blacklist the sample module until a patched kernel is deployed
echo 'blacklist damon_sample_mtier' | sudo tee /etc/modprobe.d/damon-sample-mtier.conf
sudo rmmod damon_sample_mtier 2>/dev/null || true