CVE-2026-68164

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/damon/core: disallow overlapping input ranges for damon_set_regions()<br /> <br /> damon_set_regions() assumes the input ranges are sorted by the address and<br /> don&amp;#39;t overlap each other. Hence the assumption was initially to be<br /> explicitly validated. But commit 97d482f4592f ("mm/damon/sysfs: reuse<br /> damon_set_regions() for regions setting") has mistakenly removed the<br /> validation.<br /> <br /> This can make DAMON behave in unexpected ways. At the best, the<br /> monitoring results snapshot will just look weird since there will be<br /> overlapping regions. DAMOS will also work weirdly, applying the same<br /> action multiple times for overlapping regions, and make DAMOS quota weird.<br /> More seriously, depending on the setup and regions updates sequence,<br /> negative size regions can be made. It will trigger WARN_ONCE() if the<br /> kernel is built with CONFIG_DAMON_DEBUG_SANITY=y. Depending on the<br /> monitoring results, the negative size region can further trigger division<br /> by zero in damon_merge_two_regions().<br /> <br /> Note that some of the consequences including the WARN_ONCE() and the<br /> divide by zero depend on commits that were introduced after the root cause<br /> commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for<br /> regions setting").<br /> <br /> Fix the problems by checking the assumption and returning an error if<br /> the input ranges don&amp;#39;t meet the assumption.<br /> <br /> The issue was discovered [1] by Sashiko.