CVE-2026-98505 Overview
CVE-2026-98505 is a race condition in the Linux kernel's Data Access MONitor (DAMON) subsystem. The flaw resides in the damon_hugetlb_mkold() function within mm/damon/vaddr.c. The function reads a page table entry (PTE) into a local variable, clears the accessed bit, and writes the value back. Hardware-driven PTE updates occurring in parallel can be silently overwritten and lost. Lost updates include hardware-maintained dirty bits for hugetlb pages. The issue was reported by Sashiko and resolved upstream by switching to huge_ptep_get_and_clear().
Critical Impact
Concurrent hardware updates to hugetlb page table entries can be lost during DAMON monitoring, potentially corrupting dirty-bit state tracked by the kernel.
Affected Products
- Linux kernel versions containing the damon_hugetlb_mkold() implementation in mm/damon/vaddr.c
- Systems using DAMON for hugetlbfs memory region monitoring
- Distributions shipping affected stable kernel branches referenced in upstream commits
Discovery Timeline
- 2026-10-18 - CVE-2026-98505 published to the National Vulnerability Database
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98505
Vulnerability Analysis
The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367] in the Linux memory management subsystem. DAMON provides data access pattern monitoring for virtual address spaces, including hugetlb-backed regions. During a scan cycle, damon_hugetlb_mkold() must clear the accessed bit on hugetlb PTEs so a later walk can determine whether the page was touched.
The original implementation performed a non-atomic read-modify-write of the PTE. The function copied the PTE value to a local variable, cleared the accessed bit in the copy, and wrote the copy back. Between the read and the write, the Memory Management Unit (MMU) could update the live PTE to set the dirty bit when a parallel write touches the page. The subsequent write-back from DAMON overwrites those hardware updates with stale data.
Root Cause
The root cause is the absence of atomicity between the PTE read and the PTE update. Hardware MMU updates to accessed and dirty bits are not synchronized with software readers unless the PTE is first cleared under the page table lock. Without a clearing operation, parallel hardware updates are discarded when DAMON writes back its locally held copy.
Attack Vector
The condition is a kernel correctness bug rather than a remotely reachable attack vector. Triggering the race requires DAMON to be actively monitoring a hugetlbfs region while a workload performs writes against the same hugetlb pages. Because hugetlb pages are not reclaimed and hugetlbfs is in-memory, no critical data loss path has been identified in the upstream analysis. The impact is incorrect dirty-bit accounting for hugetlb-backed memory.
See the upstream fixes for implementation details: Kernel Commit 00457981327c, Kernel Commit 39c0ceedd54, Kernel Commit 6e74ffc9ecf, Kernel Commit 7ed1062d15, and Kernel Commit e59cb7eda7c.
Detection Methods for CVE-2026-98505
Indicators of Compromise
- No runtime indicators of compromise are published for this vulnerability. The bug produces silent correctness errors rather than observable artifacts.
- Inconsistent dirty-bit accounting on hugetlb-backed memory while DAMON monitoring is active may suggest exposure.
Detection Strategies
- Enumerate kernel versions across the fleet and compare against the fixed commits linked in the NVD advisory.
- Identify workloads enabling DAMON on hugetlbfs regions using damon_reclaim, damo, or sysfs configuration under /sys/kernel/mm/damon/.
- Audit kernel build configurations for CONFIG_DAMON_VADDR and CONFIG_HUGETLBFS enablement on long-running servers.
Monitoring Recommendations
- Track kernel version drift and patch state through endpoint telemetry and configuration management.
- Alert on changes to DAMON sysfs attributes on production hosts handling hugetlb workloads.
- Correlate kernel package updates with reboots to confirm patched kernels are active.
How to Mitigate CVE-2026-98505
Immediate Actions Required
- Apply the stable kernel update containing the huge_ptep_get_and_clear() fix for damon_hugetlb_mkold().
- Prioritize patching hosts that run DAMON against hugetlbfs regions, including memory tiering and reclaim pipelines.
- Validate distribution kernel package metadata to confirm the fix is backported in the installed build.
Patch Information
The fix replaces the non-atomic read-modify-write sequence with huge_ptep_get_and_clear(), which clears the PTE while returning its current value under the page table lock. A parallel write after clearing triggers a page fault that waits on the page table lock, serializing against DAMON. The patch is distributed across upstream commits 00457981327c, 39c0ceedd54, 6e74ffc9ecf, 7ed1062d15, and e59cb7eda7c.
Workarounds
- Disable DAMON monitoring of hugetlbfs-backed regions until the patched kernel is deployed.
- Avoid configuring DAMON schemes that call damon_hugetlb_mkold() on production hugetlb workloads.
- Where feasible, unload or disable the DAMON subsystem by removing CONFIG_DAMON_VADDR consumers from active scans.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
