CVE-2026-46020

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/damon/core: validate damos_quota_goal-&gt;nid for node_mem_{used,free}_bp<br /> <br /> Patch series "mm/damon/core: validate damos_quota_goal-&gt;nid".<br /> <br /> node_mem[cg]_{used,free}_bp DAMOS quota goals receive the node id. The<br /> node id is used for si_meminfo_node() and NODE_DATA() without proper<br /> validation. As a result, privileged users can trigger an out of bounds<br /> memory access using DAMON_SYSFS. Fix the issues.<br /> <br /> The issue was originally reported [1] with a fix by another author. The<br /> original author announced [2] that they will stop working including the<br /> fix that was still in the review stage. Hence I&amp;#39;m restarting this.<br /> <br /> <br /> This patch (of 2):<br /> <br /> Users can set damos_quota_goal-&gt;nid with arbitrary value for<br /> node_mem_{used,free}_bp. But DAMON core is using those for<br /> si_meminfo_node() without the validation of the value. This can result in<br /> out of bounds memory access. The issue can actually triggered using DAMON<br /> user-space tool (damo), like below.<br /> <br /> $ sudo ./damo start --damos_action stat \<br /> --damos_quota_goal node_mem_used_bp 50% -1 \<br /> --damos_quota_interval 1s<br /> $ sudo dmesg<br /> [...]<br /> [ 65.565986] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098<br /> <br /> Fix this issue by adding the validation of the given node. If an invalid<br /> node id is given, it returns 0% for used memory ratio, and 100% for free<br /> memory ratio.