CVE-2026-52905
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
09/06/2026
Last modified:
23/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
mm/damon/core: disallow non-power of two min_region_sz on damon_start()<br />
<br />
Commit d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") introduced<br />
a bug that allows unaligned DAMON region address ranges. Commit<br />
c80f46ac228b ("mm/damon/core: disallow non-power of two min_region_sz")<br />
fixed it, but only for damon_commit_ctx() use case. Still, DAMON sysfs<br />
interface can emit non-power of two min_region_sz via damon_start(). Fix<br />
the path by adding the is_power_of_2() check on damon_start().<br />
<br />
The issue was discovered by sashiko [1].
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.18 (including) | 6.18.30 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19 (including) | 7.0.4 (excluding) |
To consult the complete list of CPE names with products and versions, see this page