CVE-2026-89796: Linux Kernel DAMON Race Condition Vulnerability

CVE-2026-89796 Overview

CVE-2026-89796 is a Linux kernel vulnerability in the Data Access MONitor (DAMON) subsystem. The flaw resides in mm/damon/core.c, specifically in the kdamond_merge_regions() function. An unsigned integer overflow can bypass the loop break condition, causing the kernel thread to enter an infinite loop. The issue triggers only under specific configurations where the maximum merge threshold exceeds UINT_MAX / 2 and the number of DAMON regions cannot be reduced below the user-defined upper limit. The bug was reported by Sashiko as part of a broader DAMON fix series covering infinite loops, NULL dereferences, and races.

Critical Impact
A kernel thread inside DAMON can enter an unbounded loop, consuming CPU resources and degrading system responsiveness under unusual memory monitoring configurations.

Affected Products

Linux kernel (mainline) — DAMON subsystem in mm/damon/core.c
Stable kernel branches receiving the fix via commits 123e4619ab6c and 8a96a06e04d2
Systems using DAMON with large aggregation-to-sampling interval ratios and many non-contiguous regions

Discovery Timeline

2026-09-16 - CVE-2026-89796 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89796

Vulnerability Analysis

DAMON tracks memory access patterns by maintaining a set of monitored regions. Online parameter updates can cause the region count to exceed the user-configured upper limit. The kdamond_merge_regions() function repeatedly merges adjacent regions, doubling the merge threshold each iteration until it reaches a theoretical maximum. The loop is expected to terminate when the threshold surpasses max_thres, since further merging cannot reduce region count below the limit in certain configurations. This is a kernel-level Infinite Loop condition [CWE-835] driven by an unsigned Integer Overflow [CWE-190].

Root Cause

The termination check compares the next threshold against max_thres after doubling. When max_thres exceeds UINT_MAX / 2, doubling the threshold causes an unsigned integer wraparound. The wrapped value falls below max_thres, bypassing the break condition. If the region count cannot be reduced below the user-defined ceiling — for example, due to many non-contiguous user-defined regions — the loop iterates indefinitely inside the kdamond kernel thread.

Attack Vector

The condition requires local configuration of DAMON with an unrealistically large aggregation interval relative to the sampling interval, combined with a region layout that resists merging. Reaching the trigger requires privileged configuration access to DAMON parameters through sysfs or debugfs. No remote attack path exists. The practical impact is a CPU-bound kdamond thread rather than memory corruption or privilege escalation.

No verified proof-of-concept code is available. See the kernel commits 123e4619ab6c and 8a96a06e04d2 for the upstream fix, which reorders the break condition check to occur before threshold doubling and clamps the threshold to prevent overflow.

Detection Methods for CVE-2026-89796

Indicators of Compromise

Sustained high CPU utilization by a kdamond kernel thread with no corresponding workload change
DAMON monitoring output stalling or ceasing to update while the associated kernel thread remains runnable
System logs showing soft lockup or RCU stall warnings referencing kdamond_merge_regions or mm/damon/core.c

Detection Strategies

Inspect running kernel threads for kdamond processes consuming a full CPU core over extended periods using top, ps, or perf
Audit DAMON configuration parameters exposed under /sys/kernel/mm/damon/ for aggregation-to-sampling ratios that could push max_thres above UINT_MAX / 2
Correlate kernel warning messages with the DAMON subsystem in centralized logging pipelines

Monitoring Recommendations

Collect kernel stack traces from long-running kdamond threads to confirm the loop is inside kdamond_merge_regions()
Track kernel version inventory across the fleet to identify hosts running vulnerable DAMON code
Enable soft lockup detection (kernel.softlockup_panic or logging) to surface stalled kernel threads promptly

How to Mitigate CVE-2026-89796

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 123e4619ab6c and 8a96a06e04d2 once available in your distribution
Audit any DAMON deployments and reset unusual aggregation interval or region-count configurations that could trigger the overflow condition
Restart or disable DAMON on systems exhibiting stuck kdamond threads until patches are applied

Patch Information

The fix is available in the stable Linux kernel tree via commit 123e4619ab6c and commit 8a96a06e04d2. The patch moves the loop termination check before the threshold-doubling operation and caps the threshold at the theoretical maximum, eliminating the overflow path. Distribution kernels should pull the corresponding backports.

Workarounds

Disable DAMON entirely on affected hosts if it is not required for workload analysis
Constrain DAMON configuration so that the aggregation interval relative to the sampling interval keeps max_thres well below UINT_MAX / 2
Restrict access to DAMON sysfs and debugfs interfaces to trusted administrators to prevent unsafe parameter changes

bash

# Check whether DAMON is enabled and inspect kdamond threads
grep CONFIG_DAMON /boot/config-$(uname -r)
ps -eLo pid,comm,pcpu | grep kdamond

# Disable a running DAMON context (root required)
echo off > /sys/kernel/mm/damon/admin/kdamonds/0/state