CVE-2026-64458 Linux CVE debrief

Who should care

Linux kernel users and administrators, Linux distributions, and security teams responsible for vulnerability management and system security should verify their systems' exposure and update to a patched version if available. Affected operators and platforms may be impacted by this vulnerability.

Why it matters

A divide-by-zero vulnerability in the Linux kernel's damon_hot_score() function can cause system crashes or unexpected behavior. Linux kernel users and administrators should verify their systems' exposure and update to a patched version if available.

• Verify system exposure and update to a patched version
• Monitor system logs for potential exploitation attempts
• Review system configurations for vulnerable settings

Technical summary

The Linux kernel's damon_hot_score() function is vulnerable to a divide-by-zero error when the sampling interval is set to zero. Additionally, incorrect handling of extreme aggregation intervals can lead to out-of-bounds array access. The vulnerability was resolved by fixing the damon_max_nr_accesses() and damon_hot_score() functions to handle extreme intervals correctly. Linux kernel users should verify their systems' exposure and update to a patched version if available. The fix addresses divide-by-zero errors and out-of-bounds array access issues.

Defensive priority

Linux kernel users should verify their systems' exposure and update to a patched version if available.

Recommended defensive actions

• Verify Linux kernel version and check for updates
• Review system configurations for vulnerable settings
• Monitor system logs for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The issue was discovered [1] by Sashiko. The vulnerability was resolved by explicitly handling the zero intervals in damon_max_nr_accesses() and applying [0, DAMOS_MAX_SCORE] bounds before returning from damon_hot_score(). The fix addresses divide-by-zero errors and out-of-bounds array access issues. Linux kernel users should verify their systems' exposure and update to a patched version if available. Evidence is limited to public sources and may not be comprehensive.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.