CVE-2026-90004: Linux Kernel Use-After-Free Vulnerability

CVE-2026-90004 Overview

CVE-2026-90004 is a Linux kernel vulnerability in the Data Access Monitor (DAMON) memory management subsystem. The flaw resides in damon_apply_min_nr_regions() within mm/damon/core, which repeatedly splits memory regions to satisfy the user-defined minimum region count. The loop assumes damon_split_region_at() always succeeds. When the split silently fails, for example due to a memory allocation failure on the last region, the linked-list traversal returns an invalid pointer. This can lead to invalid memory dereference and memory corruption inside kernel space.

Critical Impact
A failed region split in DAMON can trigger invalid pointer dereference and kernel memory corruption, with potential for kernel instability or crash.

Affected Products

Linux kernel versions containing the DAMON apply_min_nr_regions() implementation prior to the fix
Distributions shipping the affected upstream mm/damon/core code
Systems using DAMON-based memory access monitoring or DAMOS schemes

Discovery Timeline

2026-09-16 - CVE-2026-90004 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90004

Vulnerability Analysis

DAMON is the Linux kernel's data access monitoring framework used to observe memory access patterns for tuning and policy enforcement. The function damon_apply_min_nr_regions() enforces a lower bound on the number of monitored regions by splitting existing regions until the count meets the user-configured minimum.

The loop repeatedly calls damon_split_region_at() on each region without validating the return status. Silent failures of the split, most plausibly from a memory allocation failure inside the split routine, leave the region list in an unexpected state. When the failing region is the last element, the next-region fetch through the linked list returns an invalid pointer.

Subsequent dereference of that pointer yields invalid memory access and possible corruption. Even when the last-region case does not occur, the loop keeps stressing the allocator by attempting splits on other targets, amplifying the failure mode.

Root Cause

The root cause is missing error handling on the return value of damon_split_region_at(). The code path assumes success and continues iterating over a linked list whose invariants no longer hold. This is a classic unchecked-return-value defect leading to invalid pointer use within kernel context.

Attack Vector

Exploitation requires a condition where the internal kernel allocation used by damon_split_region_at() fails. Triggering the flaw generally requires local access with the ability to configure DAMON parameters, combined with memory pressure sufficient to cause allocation failure. The primary observable impact is kernel instability and potential memory corruption rather than a remote attack surface.

// No verified public exploit code is available for CVE-2026-90004.
// The defect is a missing error check on damon_split_region_at() in
// mm/damon/core.c inside damon_apply_min_nr_regions().
// See the upstream commits referenced in the NVD entry for the fix.

Detection Methods for CVE-2026-90004

Indicators of Compromise

Kernel oops or panic messages referencing damon_apply_min_nr_regions or damon_split_region_at in mm/damon/core.c
dmesg entries showing invalid pointer dereference or NULL pointer traces originating from DAMON code paths
Unexpected termination of DAMON monitoring targets or DAMOS schemes coinciding with high memory pressure

Detection Strategies

Compare running kernel version and patch level against the upstream fix commits 463ebd63e8ee3d73022a18915ea43320dad8aad7 and c608748607620f331196ed0ba9fe4017892c1457
Audit systems that enable DAMON (CONFIG_DAMON) and expose the DAMON sysfs interface to non-root or workload tenants
Correlate kernel crash dumps with DAMON activity logs to identify triggering configurations

Monitoring Recommendations

Ship kernel logs and crash reports to a centralized platform and alert on stack traces containing DAMON symbols
Monitor host memory pressure metrics on systems running DAMON to detect conditions that could induce allocator failure
Track kernel package versions across the fleet to identify hosts still exposed to the pre-patch code path

How to Mitigate CVE-2026-90004

Immediate Actions Required

Apply distribution kernel updates that include the upstream fixes referenced by the NVD entry
Restrict access to DAMON sysfs interfaces so only trusted administrative users can configure monitoring parameters
On unpatched hosts, disable DAMON where the feature is not operationally required

Patch Information

The upstream fix breaks all loops in damon_apply_min_nr_regions() on any region split failure rather than assuming success. This accepts a temporary min_nr_regions violation, which is re-evaluated on the next aggregation interval. Patch details are available in Kernel Git Commit 463ebd6 and Kernel Git Commit c6087486.

Workarounds

Disable DAMON via kernel configuration or by not loading the module on systems where memory access monitoring is not required
Reduce memory pressure on affected hosts to lower the probability of allocator failure inside damon_split_region_at()
Limit DAMON configuration privileges by tightening permissions on the DAMON sysfs interface

bash

# Check whether DAMON is enabled and in use on the running kernel
zgrep -i CONFIG_DAMON /proc/config.gz 2>/dev/null || \
    grep -i CONFIG_DAMON /boot/config-$(uname -r)

# Restrict access to the DAMON sysfs interface to root only
chmod -R o-rwx /sys/kernel/mm/damon 2>/dev/null || true