CVE-2026-74645
Received Received - Intake

Division by Zero in Linux Kernel DAMON LRU Sort

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: error out for >10000 active_mem_bp damos_quota_score() can trigger division by zero if the target value is zero. DAMON_LRU_SORT lets users set the target value for the hot memory scheme via active_mem_bp parameter. It avoids setting it as the target value if the parameter value is zero. However, it also sets the cold memory scheme with a target value that is calculated as '10000 - active_mem_bp + 2'. Hence, if a user sets active_mem_bp 10002, the cold memory scheme's quota goal target value can be zero. As a result, division by zero can be triggered. Fix by returning an error when the user tries to start DAMON with >10000 active_mem_bp parameter value. It makes no sense to set active_mem_bp with 10002. It also requires module parameters write permission to reproduce the issue. That said, the consequence is quite bad. One reliable way to reproduce the issue is like below: # cd /sys/module/damon_lru_sort/parameters # echo 1000 > wmarks_high # echo 995 > wmarks_mid # echo 0 > wmarks_low # echo 10002 > active_mem_bp # echo Y > enabled # dmesg -w [...] [ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI [ 597.428848] RIP: 0010:damos_quota_score+0x6f/0x480 This issue was discovered [1] by Sashiko.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74645
EUVD
EUVD-2026-64582

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a division by zero error in the DAMON memory management subsystem. It occurs when the active_mem_bp parameter exceeds 10000, causing the cold memory scheme's target value to become zero. This triggers a division by zero in the damos_quota_score function, leading to a kernel oops or crash.

Detection Guidance

This vulnerability can be detected by checking for the presence of the DAMON_LRU_SORT module and attempting to set the active_mem_bp parameter to a value greater than 10000. If the system crashes with a divide error, the vulnerability is present. Use commands like 'cd /sys/module/damon_lru_sort/parameters' and 'echo 10002 > active_mem_bp' to test.

Impact Analysis

The impact includes system instability or crashes due to kernel oops, requiring a reboot to recover. It requires module parameter write permissions to exploit, meaning local attackers with sufficient privileges could cause denial of service. Normal users without such permissions are not directly affected.

Mitigation Strategies

To mitigate this vulnerability, ensure the active_mem_bp parameter is set to a value less than or equal to 10000. Avoid setting it to values that could cause division by zero. Apply kernel patches that fix this issue if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74645. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart