PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46020 Linux CVE debrief

A validation flaw in the Linux kernel's DAMON (Data Access MONitor) subsystem allows privileged users to trigger out-of-bounds memory access through the DAMON_SYSFS interface. The vulnerability exists in the handling of `damos_quota_goal->nid` (node ID) parameters for `node_mem_{used,free}_bp` quota goals, which are passed to `si_meminfo_node()` and `NODE_DATA()` without proper bounds checking. An attacker with root privileges can exploit this by supplying an invalid node ID (such as -1) via the `damo` user-space tool, resulting in a NULL pointer dereference and potential kernel crash. The fix adds validation to ensure the node ID is valid before use, returning safe default values (0% used, 100% free) when an invalid node is specified.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators, kernel maintainers, and security teams managing systems with DAMON enabled; particularly relevant for environments using memory monitoring and optimization features in production workloads

Technical summary

The DAMON (Data Access MONitor) subsystem in the Linux kernel fails to validate the `nid` (node ID) field in `damos_quota_goal` structures when processing `node_mem_{used,free}_bp` quota goals. This field is used directly in calls to `si_meminfo_node()` and `NODE_DATA()` without bounds checking. A privileged attacker can trigger the vulnerability by configuring DAMON through the DAMON_SYSFS interface with an invalid node ID (e.g., -1), causing the kernel to dereference a NULL pointer at offset 0x98. The vulnerability is exploitable locally with root privileges using the `damo` user-space tool. The fix implements proper node ID validation, returning 0% for used memory and 100% for free memory when an invalid node is specified, preventing the out-of-bounds access.

Defensive priority

medium

Recommended defensive actions

  • Apply the referenced kernel patches (commits 40250b2dded0604a112be605f3828700d80ad7c2, b09958e235f2b9cd3898b85a8529172afa80d212, bcad74078708f2330a45b55358ebc38f8f4b1127) to affected systems
  • Restrict access to DAMON_SYSFS and damo tooling to trusted administrative users only
  • Monitor for suspicious DAMON configuration attempts with invalid node IDs in system logs
  • Upgrade to kernel versions containing the validated fix when available through distribution channels

Evidence notes

The CVE description confirms the vulnerability was resolved via kernel patches. The issue was originally reported by another author who subsequently stopped working on the fix; the current patch series restarts that effort. The vulnerability requires privileged access (sudo/damo) to trigger. Three kernel.org stable commits are referenced as fixes.

Official resources

2026-05-27