CVE-2026-80592: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80592 Overview

CVE-2026-80592 is a Linux kernel defect in the samples/damon/mtier module. The Data Access MONitor (DAMON) subsystem exposes a memory-tiering sample that constructs monitoring regions from user-supplied node address parameters. When those parameters are not initialized, or when the target NUMA node is memoryless, the module invokes damon_new_region() with a zero-size range. This violates the invariant documented on struct damon_region, which requires @ar to be a non-zero positive size. Kernels built with DAMON_DEBUG_SANITY trigger a WARN_ONCE() at mm/damon/core.c:217. The fix validates the address range parameters before calling damon_new_region() and fails early when they are invalid.

Critical Impact
Local users with permission to enable the DAMON mtier sample module can trigger a kernel warning and pollute kernel logs by supplying uninitialized or memoryless-node address parameters.

Affected Products

Linux kernel builds that include the samples/damon/mtier module
Kernels compiled with DAMON_DEBUG_SANITY enabled
Systems exposing DAMON sample module parameters through sysfs

Discovery Timeline

2026-08-28 - CVE-2026-80592 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80592

Vulnerability Analysis

The samples/damon/mtier module implements a DAMON memory-tiering demonstration. It builds a monitoring context by calling damon_sample_mtier_build_ctx(), which in turn passes address ranges derived from node0_start_addr, node0_end_addr, node1_start_addr, and node1_end_addr to damon_set_regions() and damon_new_region().

The struct damon_region contract requires the address range @ar to be a non-zero positive size. When the mtier sample module is enabled through its sysfs interface before those node address parameters are initialized, start equals end equals 0. The damon_verify_new_region() sanity check then fires WARN_ONCE() with the message start 0 >= end 0 at mm/damon/core.c:217.

The same condition arises when detect_node_addresses is true and node 0 or node 1 is memoryless, because the auto-detected range collapses to zero length. The upstream fix validates parameters immediately before damon_new_region() and aborts the setup path when the range is invalid.

Root Cause

The root cause is missing input validation on the address-range parameters consumed by the mtier sample. The module trusts values supplied through module parameters or NUMA auto-detection without confirming that start < end before constructing DAMON regions.

Attack Vector

A local user with the privileges required to write the module parameter through sysfs (typically root) can enable the sample module before initializing the node address parameters. The write path traverses sysfs_kf_write → param_attr_store → damon_sample_mtier_enable_store → damon_sample_mtier_start → damon_sample_mtier_build_ctx, ultimately reaching damon_new_region() with a zero-length range and tripping the kernel warning. The issue is a correctness and robustness bug rather than a remote or unauthenticated attack path.

See the upstream fix commits for the exact validation logic: Kernel Git Commit 7746d72, Kernel Git Commit 9d360fb, and Kernel Git Commit db20589.

Detection Methods for CVE-2026-80592

Indicators of Compromise

Kernel log entries containing start 0 >= end 0 originating from mm/damon/core.c:217.
WARN_ONCE() stack traces referencing damon_new_region, damon_set_regions, damon_sample_mtier_build_ctx, and damon_sample_mtier_start.
Writes to the mtier sample module's enable parameter under /sys/module/damon_sample_mtier/parameters/ prior to node address configuration.

Detection Strategies

Monitor dmesg and journalctl -k for the DAMON warning signature and correlate with the writing process ID captured in the trace.
Audit sysfs writes to DAMON sample module parameters to identify unexpected enablement attempts.
Track kernel taint state changes triggered by WARN_ONCE() on affected hosts.

Monitoring Recommendations

Forward kernel logs from Linux hosts into a centralized log platform and alert on the DAMON warning string.
Baseline which systems legitimately load the damon_sample_mtier module and treat activation elsewhere as anomalous.
Review NUMA topology on hosts that enable DAMON tiering to identify memoryless nodes that could re-trigger the condition after patching if custom code reintroduces the pattern.

How to Mitigate CVE-2026-80592

Immediate Actions Required

Apply the upstream stable-tree patches referenced in the NVD entry to all affected kernels.
Disable or unload the damon_sample_mtier module on production systems that do not require the DAMON tiering demonstration.
Restrict write access to DAMON sample module parameters under /sys/module/ to trusted administrators only.

Patch Information

The fix validates address-range parameters before calling damon_new_region() and returns early when the range is invalid. It is delivered through the following upstream commits: Kernel Git Commit 7746d72, Kernel Git Commit 9d360fb, and Kernel Git Commit db20589. Rebuild affected kernels or install the vendor-supplied stable kernel update that incorporates these commits.

Workarounds

Do not enable the mtier sample module until node0_start_addr, node0_end_addr, node1_start_addr, and node1_end_addr are set to valid non-zero ranges.
Leave detect_node_addresses disabled on hosts where node 0 or node 1 is memoryless.
Build kernels without the samples/damon/mtier sample when it is not needed operationally.

bash

# Verify the mtier sample module is not loaded and blacklist it if unused
lsmod | grep damon_sample_mtier
echo 'blacklist damon_sample_mtier' | sudo tee /etc/modprobe.d/blacklist-damon-mtier.conf
sudo modprobe -r damon_sample_mtier 2>/dev/null || true

# Only enable after validating node address parameters are non-zero
cat /sys/module/damon_sample_mtier/parameters/node0_start_addr
cat /sys/module/damon_sample_mtier/parameters/node0_end_addr
cat /sys/module/damon_sample_mtier/parameters/node1_start_addr
cat /sys/module/damon_sample_mtier/parameters/node1_end_addr