CVE-2026-74645

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74645", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.923Z", "datePublished": "2026-08-22T15:32:22.645Z", "dateUpdated": "2026-08-22T15:32:22.645Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:22.645Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/lru_sort: error out for >10000 active_mem_bp\n\ndamos_quota_score() can trigger division by zero if the target value is\nzero. DAMON_LRU_SORT lets users set the target value for the hot memory\nscheme via active_mem_bp parameter. It avoids setting it as the target\nvalue if the parameter value is zero. However, it also sets the cold\nmemory scheme with a target value that is calculated as '10000 -\nactive_mem_bp + 2'. Hence, if a user sets active_mem_bp 10002, the cold\nmemory scheme's quota goal target value can be zero. As a result,\ndivision by zero can be triggered. Fix by returning an error when the\nuser tries to start DAMON with >10000 active_mem_bp parameter value.\n\nIt makes no sense to set active_mem_bp with 10002. It also requires\nmodule parameters write permission to reproduce the issue. That said, the\nconsequence is quite bad.\n\nOne reliable way to reproduce the issue is like below:\n\n # cd /sys/module/damon_lru_sort/parameters\n # echo 1000 > wmarks_high\n # echo 995 > wmarks_mid\n # echo 0 > wmarks_low\n # echo 10002 > active_mem_bp\n # echo Y > enabled\n # dmesg -w\n [...]\n [ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI\n [ 597.428848] RIP: 0010:damos_quota_score+0x6f/0x480\n\nThis issue was discovered [1] by Sashiko."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/damon/lru_sort.c"], "versions": [{"version": "40d98d31cd7060228e03303c5c34ae7101020416", "lessThan": "e7e5e5e0dfe2ea171044c24c263efae4ee882b3f", "status": "affected", "versionType": "git"}, {"version": "40d98d31cd7060228e03303c5c34ae7101020416", "lessThan": "06befa61c427e74319781e6f35a364cfc32dbae8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/damon/lru_sort.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e7e5e5e0dfe2ea171044c24c263efae4ee882b3f"}, {"url": "https://git.kernel.org/stable/c/06befa61c427e74319781e6f35a364cfc32dbae8"}], "title": "mm/damon/lru_sort: error out for >10000 active_mem_bp", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/damon/lru_sort.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e7e5e5e0dfe2ea171044c24c263efae4ee882b3f", "status": "affected", "version": "40d98d31cd7060228e03303c5c34ae7101020416", "versionType": "git"}, {"lessThan": "06befa61c427e74319781e6f35a364cfc32dbae8", "status": "affected", "version": "40d98d31cd7060228e03303c5c34ae7101020416", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/damon/lru_sort.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/lru_sort: error out for >10000 active_mem_bp\n\ndamos_quota_score() can trigger division by zero if the target value is\nzero. DAMON_LRU_SORT lets users set the target value for the hot memory\nscheme via active_mem_bp parameter. It avoids setting it as the target\nvalue if the parameter value is zero. However, it also sets the cold\nmemory scheme with a target value that is calculated as '10000 -\nactive_mem_bp + 2'. Hence, if a user sets active_mem_bp 10002, the cold\nmemory scheme's quota goal target value can be zero. As a result,\ndivision by zero can be triggered. Fix by returning an error when the\nuser tries to start DAMON with >10000 active_mem_bp parameter value.\n\nIt makes no sense to set active_mem_bp with 10002. It also requires\nmodule parameters write permission to reproduce the issue. That said, the\nconsequence is quite bad.\n\nOne reliable way to reproduce the issue is like below:\n\n # cd /sys/module/damon_lru_sort/parameters\n # echo 1000 > wmarks_high\n # echo 995 > wmarks_mid\n # echo 0 > wmarks_low\n # echo 10002 > active_mem_bp\n # echo Y > enabled\n # dmesg -w\n [...]\n [ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI\n [ 597.428848] RIP: 0010:damos_quota_score+0x6f/0x480\n\nThis issue was discovered [1] by Sashiko."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/lru_sort: devuelve un error para >10000 active_mem_bp\n\ndamos_quota_score() puede desencadenar una divisi\u00f3n por cero si el valor objetivo es cero. DAMON_LRU_SORT permite a los usuarios establecer el valor objetivo para el esquema de memoria caliente a trav\u00e9s del par\u00e1metro active_mem_bp. Evita establecerlo como valor objetivo si el valor del par\u00e1metro es cero. Sin embargo, tambi\u00e9n establece el esquema de memoria fr\u00eda con un valor objetivo que se calcula como '10000 - active_mem_bp + 2'. Por lo tanto, si un usuario establece active_mem_bp en 10002, el valor objetivo de la cuota del esquema de memoria fr\u00eda puede ser cero. Como resultado, se puede desencadenar una divisi\u00f3n por cero. Se soluciona devolviendo un error cuando el usuario intenta iniciar DAMON con un valor de par\u00e1metro active_mem_bp >10000.\n\nNo tiene sentido establecer active_mem_bp en 10002. Tambi\u00e9n requiere permiso de escritura para los par\u00e1metros del m\u00f3dulo para reproducir el problema. Dicho esto, la consecuencia es bastante grave.\n\nUna forma fiable de reproducir el problema es la siguiente:\n\n # cd /sys/module/damon_lru_sort/parameters\n # echo 1000 > wmarks_high\n # echo 995 > wmarks_mid\n # echo 0 > wmarks_low\n # echo 10002 > active_mem_bp\n # echo Y > enabled\n # dmesg -w\n [...]\n [ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI\n [ 597.428848] RIP: 0010:damos_quota_score+0x6f/0x480\n\nEste problema fue descubierto [1] por Sashiko."}], "id": "CVE-2026-74645", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:37.837", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06befa61c427e74319781e6f35a364cfc32dbae8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7e5e5e0dfe2ea171044c24c263efae4ee882b3f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mm/damon/lru_sort: error out for >10000 active_mem_bp", "id": "2521444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521444"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-369", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm/damon/lru_sort: error out for >10000 active_mem_bp\ndamos_quota_score() can trigger division by zero if the target value is\nzero. DAMON_LRU_SORT lets users set the target value for the hot memory\nscheme via active_mem_bp parameter. It avoids setting it as the target\nvalue if the parameter value is zero. However, it also sets the cold\nmemory scheme with a target value that is calculated as '10000 -\nactive_mem_bp + 2'. Hence, if a user sets active_mem_bp 10002, the cold\nmemory scheme's quota goal target value can be zero. As a result,\ndivision by zero can be triggered. Fix by returning an error when the\nuser tries to start DAMON with >10000 active_mem_bp parameter value.\nIt makes no sense to set active_mem_bp with 10002. It also requires\nmodule parameters write permission to reproduce the issue. That said, the\nconsequence is quite bad.\nOne reliable way to reproduce the issue is like below:\n# cd /sys/module/damon_lru_sort/parameters\n# echo 1000 > wmarks_high\n# echo 995 > wmarks_mid\n# echo 0 > wmarks_low\n# echo 10002 > active_mem_bp\n# echo Y > enabled\n# dmesg -w\n[...]\n[ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI\n[ 597.428848] RIP: 0010:damos_quota_score+0x6f/0x480\nThis issue was discovered [1] by Sashiko.", "A flaw was found in the Linux kernel's `damon_lru_sort` module. A local user with write permissions to module parameters can trigger a division-by-zero error by setting the `active_mem_bp` parameter to a specific value. This manipulation causes the `damos_quota_score()` function to attempt division by zero, leading to a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-74645", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74645\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74645\nhttps://lore.kernel.org/linux-cve-announce/2026082224-CVE-2026-74645-b952@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[40d98d31cd7060228e03303c5c34ae7101020416,e7e5e5e0dfe2ea171044c24c263efae4ee882b3f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[40d98d31cd7060228e03303c5c34ae7101020416,06befa61c427e74319781e6f35a364cfc32dbae8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T17:15:04.453915+00:00", "updated": "2026-08-25T14:15:05.825568+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-369"]}