CVE-2026-74644: Linux Kernel Memory Management Vulnerability

CVE-2026-74644 Overview

CVE-2026-74644 is a memory management flaw in the Linux kernel's Data Access MONitor (DAMON) subsystem. The vulnerability resides in mm/damon/ops-common, specifically in the folio migration path used by damon_pa_migrate() and damos_va_migrate(). When these functions isolate folios and invoke damon_migrate_pages() with an invalid target_nid (including the scheme default NUMA_NO_NODE / -1), the callee returns early without restoring the folios to the Least Recently Used (LRU) list. The isolated folios retain the extra reference taken by folio_isolate_lru(), causing them to remain off the LRU and pinning pages after the mapping is gone.

Critical Impact
Ignored DAMON migration requests leak folio references, stranding pages off the LRU and skewing anon active/inactive accounting for the lifetime of the mapping.

Affected Products

Linux kernel branches containing the DAMON ops-common migration helpers
Linux kernel builds using damon_pa_migrate() or damos_va_migrate() schemes
Systems configured with DAMON-based Non-Uniform Memory Access (NUMA) migration policies

Discovery Timeline

2026-08-22 - CVE-2026-74644 published to NVD
2026-08-23 - Last updated in NVD database

Technical Details for CVE-2026-74644

Vulnerability Analysis

DAMON is the Linux kernel's Data Access MONitor framework that enables data access-aware memory management operations. The DAMON Operation Schemes (DAMOS) allow administrators to migrate folios between NUMA nodes based on access patterns. The migration flow calls folio_isolate_lru() on each candidate folio, appending it to a local list, then hands that list to damon_migrate_pages() for the actual node transfer.

When target_nid is invalid, damon_migrate_pages() bails out early. The caller subsequently discards the local list head. Because folio_isolate_lru() already incremented the folio reference and removed the folio from its LRU list, the folios remain isolated with an extra reference held. Anon active and inactive counts drop while Resident Set Size (RSS) accounting does not, and the pages stay pinned even after the owning mapping is torn down.

Root Cause

The root cause is a missing putback path on the invalid-nid branch. damon_migrate_pages() neither migrates nor calls putback_movable_pages() when target_nid is unusable, violating the invariant that isolated folios must eventually be returned to the LRU. This qualifies as a memory leak with reference-count pinning behavior.

Attack Vector

Exploitation requires the ability to configure DAMON schemes, typically restricted to privileged users through the DAMON sysfs or debugfs interfaces. A local operator repeatedly issuing DAMOS migration actions with NUMA_NO_NODE or an out-of-range target node can gradually strand folios, degrading system memory availability and producing inconsistent memory statistics.

The fix, described in the upstream commits, adds the missing putback on the invalid-nid path so ignored migration requests still return folios to the LRU. See the kernel commit for the exact patch.

Detection Methods for CVE-2026-74644

Indicators of Compromise

Steady decline in anonymous active and inactive page counts in /proc/meminfo without a corresponding drop in process RSS.
Elevated nr_isolated_anon values in /proc/vmstat that fail to return to baseline after DAMON schemes execute.
DAMON schemes configured with a migrate action but no valid target_nid set.

Detection Strategies

Audit kernel version and DAMON configuration on hosts using damon_sysfs or damon_dbgfs to determine exposure to the vulnerable code path.
Correlate DAMON scheme apply events with subsequent memory accounting drift over rolling windows.
Monitor for unexpected NUMA_NO_NODE or negative target_nid values in DAMON scheme definitions read from sysfs.

Monitoring Recommendations

Ingest /proc/vmstat and /proc/meminfo samples into a centralized telemetry pipeline for longitudinal analysis.
Alert on divergence between anon LRU counters and aggregate process RSS across NUMA-enabled hosts.
Track DAMON sysfs write operations in kernel audit logs to identify who is deploying migration schemes.

How to Mitigate CVE-2026-74644

Immediate Actions Required

Apply the upstream stable kernel updates referenced by the fix commits and reboot affected hosts.
Inventory Linux systems that enable DAMON and identify any DAMOS migration schemes currently in use.
Restrict write access to DAMON sysfs and debugfs interfaces to trusted administrators only.

Patch Information

The fix is available in the mainline and stable branches through the following commits: Kernel Commit 460181e, Kernel Commit 5deb65c, Kernel Commit 7001c0a, and Kernel Commit cfef454. The patch adds a putback_movable_pages() call on the invalid-nid branch so ignored migrations return folios to the LRU.

Workarounds

Disable DAMOS migration actions until the patched kernel is deployed, or ensure schemes only reference valid NUMA node identifiers.
Set CONFIG_DAMON_SYSFS=n and CONFIG_DAMON_DBGFS=n on builds where DAMON is not required operationally.
Remove group permissions on /sys/kernel/mm/damon/ to prevent unprivileged scheme configuration.

bash

# Verify DAMON exposure and remove non-root access
ls -l /sys/kernel/mm/damon/admin/kdamonds/ 2>/dev/null
chmod -R o-rwx,g-rwx /sys/kernel/mm/damon/ 2>/dev/null

# Inspect any configured DAMOS migration target nodes
grep -r . /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/schemes/*/action 2>/dev/null
grep -r . /sys/kernel/mm/damon/admin/kdamonds/*/contexts/*/schemes/*/target_nid 2>/dev/null