CVE-2026-74645

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/damon/lru_sort: error out for &gt;10000 active_mem_bp<br /> <br /> damos_quota_score() can trigger division by zero if the target value is<br /> zero. DAMON_LRU_SORT lets users set the target value for the hot memory<br /> scheme via active_mem_bp parameter. It avoids setting it as the target<br /> value if the parameter value is zero. However, it also sets the cold<br /> memory scheme with a target value that is calculated as &amp;#39;10000 -<br /> active_mem_bp + 2&amp;#39;. Hence, if a user sets active_mem_bp 10002, the cold<br /> memory scheme&amp;#39;s quota goal target value can be zero. As a result,<br /> division by zero can be triggered. Fix by returning an error when the<br /> user tries to start DAMON with &gt;10000 active_mem_bp parameter value.<br /> <br /> It makes no sense to set active_mem_bp with 10002. It also requires<br /> module parameters write permission to reproduce the issue. That said, the<br /> consequence is quite bad.<br /> <br /> One reliable way to reproduce the issue is like below:<br /> <br /> # cd /sys/module/damon_lru_sort/parameters<br /> # echo 1000 &gt; wmarks_high<br /> # echo 995 &gt; wmarks_mid<br /> # echo 0 &gt; wmarks_low<br /> # echo 10002 &gt; active_mem_bp<br /> # echo Y &gt; enabled<br /> # dmesg -w<br /> [...]<br /> [ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI<br /> [ 597.428848] RIP: 0010:damos_quota_score+0x6f/0x480<br /> <br /> This issue was discovered [1] by Sashiko.