CVE-2026-80592

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80592", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.770Z", "datePublished": "2026-08-28T06:48:20.218Z", "dateUpdated": "2026-08-28T06:48:20.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-28T06:48:20.218Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/damon/mtier: fail early if address range parameters are invalid\n\nThe comment on top of `struct damon_region` clearly says that\n\n For any use case, @ar should be non-zero positive size.\n\nwhich is now verified in damon_verify_new_region() if the kernel is built\nwith DAMON_DEBUG_SANITY.\n\nThe WARN_ONCE() can be triggered if the mtier sample module is enabled\nbefore node{0,1}_{start,end}_addr have been properly initialized, which is\nobviously not good.\n\n ------------[ cut here ]------------\n start 0 >= end 0\n WARNING: mm/damon/core.c:217 at damon_new_region+0xf4/0x118, CPU#59: bash/341468\n Call trace:\n damon_new_region+0xf4/0x118 (P)\n damon_set_regions+0xfc/0x3c0\n damon_sample_mtier_build_ctx+0xe8/0x3a8\n damon_sample_mtier_start+0x1c/0x90\n damon_sample_mtier_enable_store+0x98/0xb0\n param_attr_store+0xb4/0x128\n module_attr_store+0x2c/0x50\n sysfs_kf_write+0x58/0x90\n kernfs_fop_write_iter+0x16c/0x238\n vfs_write+0x2c0/0x370\n ksys_write+0x74/0x118\n __arm64_sys_write+0x24/0x38\n invoke_syscall+0xa8/0x118\n el0_svc_common.constprop.0+0x48/0xf0\n do_el0_svc+0x24/0x38\n el0_svc+0x54/0x370\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1ac/0x1b0\n ---[ end trace 0000000000000000 ]---\n\nNote that the same issue can happen if detect_node_addresses is true, and\nnode 0 or 1 is memoryless. Fix it together by checking the validity of\nparameters right before damon_new_region() and fail early if they're\ninvalid."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["samples/damon/mtier.c"], "versions": [{"version": "82a08bde3cf7bbbe90de57baa181bebf676582c7", "lessThan": "9d360fb820a3b9576d155e720ec44fef54d2efb5", "status": "affected", "versionType": "git"}, {"version": "82a08bde3cf7bbbe90de57baa181bebf676582c7", "lessThan": "db20589d7b248211f63f4a7f642a49c0832b13ae", "status": "affected", "versionType": "git"}, {"version": "82a08bde3cf7bbbe90de57baa181bebf676582c7", "lessThan": "7746d72c64054976887928d64d2caf25c5a6dcc0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["samples/damon/mtier.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9d360fb820a3b9576d155e720ec44fef54d2efb5"}, {"url": "https://git.kernel.org/stable/c/db20589d7b248211f63f4a7f642a49c0832b13ae"}, {"url": "https://git.kernel.org/stable/c/7746d72c64054976887928d64d2caf25c5a6dcc0"}], "title": "samples/damon/mtier: fail early if address range parameters are invalid", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["samples/damon/mtier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9d360fb820a3b9576d155e720ec44fef54d2efb5", "status": "affected", "version": "82a08bde3cf7bbbe90de57baa181bebf676582c7", "versionType": "git"}, {"lessThan": "db20589d7b248211f63f4a7f642a49c0832b13ae", "status": "affected", "version": "82a08bde3cf7bbbe90de57baa181bebf676582c7", "versionType": "git"}, {"lessThan": "7746d72c64054976887928d64d2caf25c5a6dcc0", "status": "affected", "version": "82a08bde3cf7bbbe90de57baa181bebf676582c7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["samples/damon/mtier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/damon/mtier: fail early if address range parameters are invalid\n\nThe comment on top of `struct damon_region` clearly says that\n\n For any use case, @ar should be non-zero positive size.\n\nwhich is now verified in damon_verify_new_region() if the kernel is built\nwith DAMON_DEBUG_SANITY.\n\nThe WARN_ONCE() can be triggered if the mtier sample module is enabled\nbefore node{0,1}_{start,end}_addr have been properly initialized, which is\nobviously not good.\n\n ------------[ cut here ]------------\n start 0 >= end 0\n WARNING: mm/damon/core.c:217 at damon_new_region+0xf4/0x118, CPU#59: bash/341468\n Call trace:\n damon_new_region+0xf4/0x118 (P)\n damon_set_regions+0xfc/0x3c0\n damon_sample_mtier_build_ctx+0xe8/0x3a8\n damon_sample_mtier_start+0x1c/0x90\n damon_sample_mtier_enable_store+0x98/0xb0\n param_attr_store+0xb4/0x128\n module_attr_store+0x2c/0x50\n sysfs_kf_write+0x58/0x90\n kernfs_fop_write_iter+0x16c/0x238\n vfs_write+0x2c0/0x370\n ksys_write+0x74/0x118\n __arm64_sys_write+0x24/0x38\n invoke_syscall+0xa8/0x118\n el0_svc_common.constprop.0+0x48/0xf0\n do_el0_svc+0x24/0x38\n el0_svc+0x54/0x370\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1ac/0x1b0\n ---[ end trace 0000000000000000 ]---\n\nNote that the same issue can happen if detect_node_addresses is true, and\nnode 0 or 1 is memoryless. Fix it together by checking the validity of\nparameters right before damon_new_region() and fail early if they're\ninvalid."}], "id": "CVE-2026-80592", "lastModified": "2026-08-28T08:16:42.830", "metrics": {}, "published": "2026-08-28T08:16:42.830", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7746d72c64054976887928d64d2caf25c5a6dcc0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d360fb820a3b9576d155e720ec44fef54d2efb5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db20589d7b248211f63f4a7f642a49c0832b13ae"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: samples/damon/mtier: fail early if address range parameters are invalid", "id": "2525499", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525499"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1288", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsamples/damon/mtier: fail early if address range parameters are invalid\nThe comment on top of `struct damon_region` clearly says that\nFor any use case, @ar should be non-zero positive size.\nwhich is now verified in damon_verify_new_region() if the kernel is built\nwith DAMON_DEBUG_SANITY.\nThe WARN_ONCE() can be triggered if the mtier sample module is enabled\nbefore node{0,1}_{start,end}_addr have been properly initialized, which is\nobviously not good.\n------------[ cut here ]------------\nstart 0 >= end 0\nWARNING: mm/damon/core.c:217 at damon_new_region+0xf4/0x118, CPU#59: bash/341468\nCall trace:\ndamon_new_region+0xf4/0x118 (P)\ndamon_set_regions+0xfc/0x3c0\ndamon_sample_mtier_build_ctx+0xe8/0x3a8\ndamon_sample_mtier_start+0x1c/0x90\ndamon_sample_mtier_enable_store+0x98/0xb0\nparam_attr_store+0xb4/0x128\nmodule_attr_store+0x2c/0x50\nsysfs_kf_write+0x58/0x90\nkernfs_fop_write_iter+0x16c/0x238\nvfs_write+0x2c0/0x370\nksys_write+0x74/0x118\n__arm64_sys_write+0x24/0x38\ninvoke_syscall+0xa8/0x118\nel0_svc_common.constprop.0+0x48/0xf0\ndo_el0_svc+0x24/0x38\nel0_svc+0x54/0x370\nel0t_64_sync_handler+0xa0/0xe8\nel0t_64_sync+0x1ac/0x1b0\n---[ end trace 0000000000000000 ]---\nNote that the same issue can happen if detect_node_addresses is true, and\nnode 0 or 1 is memoryless. Fix it together by checking the validity of\nparameters right before damon_new_region() and fail early if they're\ninvalid.", "A flaw was found in the Linux kernel. A local user could trigger a kernel warning by enabling the `mtier` sample module before its address range parameters are properly initialized. This issue, caused by invalid address range parameters, could lead to system instability or a denial of service."], "name": "CVE-2026-80592", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80592\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80592\nhttps://lore.kernel.org/linux-cve-announce/2026082829-CVE-2026-80592-bc8c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82a08bde3cf7bbbe90de57baa181bebf676582c7,9d360fb820a3b9576d155e720ec44fef54d2efb5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82a08bde3cf7bbbe90de57baa181bebf676582c7,db20589d7b248211f63f4a7f642a49c0832b13ae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82a08bde3cf7bbbe90de57baa181bebf676582c7,7746d72c64054976887928d64d2caf25c5a6dcc0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T09:00:10.362055+00:00", "updated": "2026-08-31T14:15:06.430622+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}