CVE-2026-74643

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74643", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.922Z", "datePublished": "2026-08-22T15:32:21.140Z", "dateUpdated": "2026-08-22T15:32:21.140Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:21.140Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/damon/mtier: error out for zero quota goal target values\n\nPatch series \"mm/damon: avoid division by zero from damos_quota_score()\".\n\nDAMON_SAMPLE_MTIER and DAMON_LRU_SORT allow the user to trigger division\nby zero in damos_quota_score(). Avoid it by adding parameters validation\nchecks.\n\n\nThis patch (of 2):\n\ndamos_quota_score() can trigger division by zero if the target_value is\nzero. DAMON_SAMPLE_MTIER lets users set the target_value via\nnode0_mem_{used,free}_bp parameters. It doesn't guard zero value case,\nthough. As a result, users can trigger division by zero. Fix the issue\nby returning an error when the user tries to start DAMON with zero\nnode0_mem_{used,free}_bp parameter values.\n\nDAMON_SAMPLE_MTIER is just a sample module, but the consequence is quite\nbad. Also the zero node0_mem_free_bp parameter might look like a\nreasonable setup to some users. Hence, the issue might really happen in\nthe real world.\n\nOne reliable way to reproduce the issue is like below:\n\n # cd /sys/module/damon_sample_mtier/parameters\n # echo 4096 > node0_start_addr\n # echo 8192 > node0_end_addr\n # echo 8192 > node1_start_addr\n # echo 81920 > node1_end_addr\n # echo 0 > node0_mem_free_bp\n # echo Y > enabled\n # dmesg -w\n [...]\n [18792.235916] Oops: divide error: 0000 [#1] SMP NOPTI\n [...]\n [18792.242787] RIP: 0010:damos_quota_score+0x6f/0x480\n [...]\n\nThis issue was discovered [1] by Sashiko."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["samples/damon/mtier.c"], "versions": [{"version": "c5e67d40a10234541e220750297304df79aaedd0", "lessThan": "e16b8d640ec99b28bc827560edcf9706e610c3aa", "status": "affected", "versionType": "git"}, {"version": "c5e67d40a10234541e220750297304df79aaedd0", "lessThan": "684f271210becd7b8c4088f06c442499e48a43a0", "status": "affected", "versionType": "git"}, {"version": "c5e67d40a10234541e220750297304df79aaedd0", "lessThan": "a16fd3ad9d89b05475864da97327870464611736", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["samples/damon/mtier.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e16b8d640ec99b28bc827560edcf9706e610c3aa"}, {"url": "https://git.kernel.org/stable/c/684f271210becd7b8c4088f06c442499e48a43a0"}, {"url": "https://git.kernel.org/stable/c/a16fd3ad9d89b05475864da97327870464611736"}], "title": "samples/damon/mtier: error out for zero quota goal target values", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["samples/damon/mtier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e16b8d640ec99b28bc827560edcf9706e610c3aa", "status": "affected", "version": "c5e67d40a10234541e220750297304df79aaedd0", "versionType": "git"}, {"lessThan": "684f271210becd7b8c4088f06c442499e48a43a0", "status": "affected", "version": "c5e67d40a10234541e220750297304df79aaedd0", "versionType": "git"}, {"lessThan": "a16fd3ad9d89b05475864da97327870464611736", "status": "affected", "version": "c5e67d40a10234541e220750297304df79aaedd0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["samples/damon/mtier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/damon/mtier: error out for zero quota goal target values\n\nPatch series \"mm/damon: avoid division by zero from damos_quota_score()\".\n\nDAMON_SAMPLE_MTIER and DAMON_LRU_SORT allow the user to trigger division\nby zero in damos_quota_score(). Avoid it by adding parameters validation\nchecks.\n\n\nThis patch (of 2):\n\ndamos_quota_score() can trigger division by zero if the target_value is\nzero. DAMON_SAMPLE_MTIER lets users set the target_value via\nnode0_mem_{used,free}_bp parameters. It doesn't guard zero value case,\nthough. As a result, users can trigger division by zero. Fix the issue\nby returning an error when the user tries to start DAMON with zero\nnode0_mem_{used,free}_bp parameter values.\n\nDAMON_SAMPLE_MTIER is just a sample module, but the consequence is quite\nbad. Also the zero node0_mem_free_bp parameter might look like a\nreasonable setup to some users. Hence, the issue might really happen in\nthe real world.\n\nOne reliable way to reproduce the issue is like below:\n\n # cd /sys/module/damon_sample_mtier/parameters\n # echo 4096 > node0_start_addr\n # echo 8192 > node0_end_addr\n # echo 8192 > node1_start_addr\n # echo 81920 > node1_end_addr\n # echo 0 > node0_mem_free_bp\n # echo Y > enabled\n # dmesg -w\n [...]\n [18792.235916] Oops: divide error: 0000 [#1] SMP NOPTI\n [...]\n [18792.242787] RIP: 0010:damos_quota_score+0x6f/0x480\n [...]\n\nThis issue was discovered [1] by Sashiko."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nsamples/damon/mtier: error al salir por valores objetivo de cuota cero\n\nSerie de parches \u201cmm/damon: evitar la divisi\u00f3n por cero de damos_quota_score()\u201d.\n\nDAMON_SAMPLE_MTIER y DAMON_LRU_SORT permiten al usuario activar la divisi\u00f3n por cero en damos_quota_score(). Ev\u00edtelo a\u00f1adiendo comprobaciones de validaci\u00f3n de par\u00e1metros.\n\nEste parche (de 2):\n\ndamos_quota_score() puede activar la divisi\u00f3n por cero si el target_value es cero. DAMON_SAMPLE_MTIER permite a los usuarios establecer el target_value a trav\u00e9s de los par\u00e1metros node0_mem_{used,free}_bp. Sin embargo, no protege el caso de valor cero. Como resultado, los usuarios pueden activar la divisi\u00f3n por cero. Solucione el problema devolviendo un error cuando el usuario intente iniciar DAMON con valores de par\u00e1metro node0_mem_{used,free}_bp cero.\n\nDAMON_SAMPLE_MTIER es solo un m\u00f3dulo de ejemplo, pero la consecuencia es bastante mala. Adem\u00e1s, el par\u00e1metro node0_mem_free_bp cero podr\u00eda parecer una configuraci\u00f3n razonable para algunos usuarios. Por lo tanto, el problema podr\u00eda ocurrir realmente en el mundo real.\n\nUna forma fiable de reproducir el problema es la siguiente:\n\n # cd /sys/module/damon_sample_mtier/parameters\n # echo 4096 > node0_start_addr\n # echo 8192 > node0_end_addr\n # echo 8192 > node1_start_addr\n # echo 81920 > node1_end_addr\n # echo 0 > node0_mem_free_bp\n # echo Y > enabled\n # dmesg -w\n [...]\n [18792.235916] Oops: error de divisi\u00f3n: 0000 [#1] SMP NOPTI\n [...]\n [18792.242787] RIP: 0010:damos_quota_score+0x6f/0x480\n [...]\n\nEste problema fue descubierto [1] por Sashiko."}], "id": "CVE-2026-74643", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:37.617", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/684f271210becd7b8c4088f06c442499e48a43a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a16fd3ad9d89b05475864da97327870464611736"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e16b8d640ec99b28bc827560edcf9706e610c3aa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: samples/damon/mtier: error out for zero quota goal target values", "id": "2521380", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521380"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-369", "details": ["A flaw was found in the Linux kernel's DAMON_SAMPLE_MTIER module. A local user can trigger a division-by-zero error in the `damos_quota_score()` function by providing zero values for the `node0_mem_used_bp` or `node0_mem_free_bp` parameters when enabling the module. This vulnerability leads to a kernel crash, resulting in a Denial of Service (DoS) for the system."], "name": "CVE-2026-74643", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74643\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74643\nhttps://lore.kernel.org/linux-cve-announce/2026082224-CVE-2026-74643-de06@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5e67d40a10234541e220750297304df79aaedd0,e16b8d640ec99b28bc827560edcf9706e610c3aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5e67d40a10234541e220750297304df79aaedd0,684f271210becd7b8c4088f06c442499e48a43a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5e67d40a10234541e220750297304df79aaedd0,a16fd3ad9d89b05475864da97327870464611736)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T17:15:04.454246+00:00", "updated": "2026-08-24T14:15:05.379091+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}