CVE-2026-74645: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74645 Overview

CVE-2026-74645 is a division-by-zero flaw in the Linux kernel's mm/damon/lru_sort subsystem. The Data Access Monitor (DAMON) LRU sort module accepts an active_mem_bp parameter that controls the hot memory scheme target value. When a user writes a value greater than 10000 to this parameter, the cold memory scheme target value, computed as 10000 - active_mem_bp + 2, becomes zero or negative. The damos_quota_score() function then triggers a divide error and kernel oops. The fix rejects active_mem_bp values greater than 10000 at configuration time.

Critical Impact
A local user with write access to the DAMON LRU sort module parameters can crash the kernel by setting active_mem_bp to a value above 10000, causing a denial of service.

Affected Products

Linux kernel builds that include the DAMON_LRU_SORT module
Systems exposing /sys/module/damon_lru_sort/parameters to privileged users
Kernel versions prior to the commits referenced in the stable tree

Discovery Timeline

2026-08-22 - CVE-2026-74645 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74645

Vulnerability Analysis

DAMON is the Linux kernel's Data Access Monitoring framework. The DAMON_LRU_SORT module reorders LRU lists based on observed access patterns to keep hot pages resident and demote cold pages. Users tune the module through sysfs parameters, including active_mem_bp, which expresses the target proportion of active (hot) memory in basis points where 10000 equals 100 percent.

The module registers two schemes: one for hot memory and one for cold memory. The cold scheme's quota target is derived from the hot scheme value with the expression 10000 - active_mem_bp + 2. When active_mem_bp equals 10002, this expression evaluates to zero. The damos_quota_score() function divides by the target value while computing quota adjustments, producing a divide error, kernel oops, and denial of service.

Root Cause

The root cause is missing input validation on the active_mem_bp module parameter [CWE-369, Divide By Zero]. The module already guards against setting the hot scheme target to zero, but it does not bound the parameter to the semantically valid range of 0 through 10000. The derived cold scheme target is therefore free to reach zero, which damos_quota_score() then uses as a divisor.

Attack Vector

Exploitation requires local access with write permission on /sys/module/damon_lru_sort/parameters/active_mem_bp, typically root or a user granted sysfs write capabilities. The reproduction sequence writes watermark values, sets active_mem_bp to 10002, and enables the module, which triggers Oops: divide error: 0000 [#1] SMP NOPTI at damos_quota_score+0x6f/0x480. The impact is limited to denial of service on the affected host.

The fix causes DAMON initialization to return an error whenever active_mem_bp exceeds 10000. See the Kernel Git Commit Change and the Kernel Git Commit Update for the upstream patches.

Detection Methods for CVE-2026-74645

Indicators of Compromise

Kernel log entries containing Oops: divide error with a call trace referencing damos_quota_score
Unexpected writes to /sys/module/damon_lru_sort/parameters/active_mem_bp with values above 10000
Sudden kernel task terminations or panics correlated with DAMON being enabled through /sys/module/damon_lru_sort/parameters/enabled

Detection Strategies

Audit write syscalls targeting files under /sys/module/damon_lru_sort/parameters/ using auditd rules or eBPF-based file access monitors.
Alert on kernel ring buffer messages that match divide error and damos_quota_score in centralized logging pipelines.
Compare running kernel versions against the fixed commits to flag hosts still exposed to the flaw.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized SIEM and create rules for kernel oops signatures.
Track privileged sysfs modifications with process, user, and command-line context to attribute unsafe parameter writes.
Monitor host availability metrics for unplanned reboots on servers where DAMON LRU sort is loaded.

How to Mitigate CVE-2026-74645

Immediate Actions Required

Update to a Linux kernel build that includes commits 06befa61c427 and e7e5e5e0dfe2 from the stable tree.
If patching is not immediate, unload the damon_lru_sort module on hosts that do not require it using modprobe -r damon_lru_sort.
Restrict write access to /sys/module/damon_lru_sort/parameters/ to trusted administrators only.

Patch Information

The upstream fix rejects active_mem_bp values greater than 10000 during DAMON start, returning an error instead of allowing the cold scheme target to reach zero. Distributions should backport commits 06befa61c427e74319781e6f35a364cfc32dbae8 and e7e5e5e0dfe2ea171044c24c263efae4ee882b3f from the kernel stable tree. Rebuild affected kernels and reboot to apply the fix.

Workarounds

Blacklist the damon_lru_sort module on systems that do not require access-aware LRU sorting.
Enforce Mandatory Access Control policies with SELinux or AppArmor to deny writes to DAMON sysfs parameters from unprivileged contexts.
Validate configuration management tooling so that any managed value for active_mem_bp stays within the 0 to 10000 range.

bash

# Configuration example: prevent unsafe active_mem_bp values and disable DAMON LRU sort
echo "blacklist damon_lru_sort" | sudo tee /etc/modprobe.d/damon-lru-sort.conf
sudo modprobe -r damon_lru_sort 2>/dev/null || true
# Optional: restrict sysfs parameter access
sudo chmod 600 /sys/module/damon_lru_sort/parameters/active_mem_bp 2>/dev/null || true