LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46067: mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp Users can set damos_quota_goal->nid with arbitrary value for node_memcg_{used,free}_bp. But DAMON core is using those for NODE-DATA() without a validation of the value. This can result in out of bounds memory access. The issue can actually triggered using DAMON user-space tool (damo), like below. $ sudo mkdir /sys/fs/cgroup/foo $ sudo ./damo start --damos_action stat --damos_quota_interval 1s \ --damos_quota_goal node_memcg_used_bp 50% -1 /foo $ sudo dmseg [...] [ 524.181426] Unable to handle kernel paging request at virtual address 0000000000002c00 Fix this issue by adding the validation of the given node id. If an invalid node id is given, it returns 0% for used memory ratio, and 100% for free memory ratio.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue lets an invalid DAMON quota goal node ID cause out-of-bounds memory access. The public record shows it can crash the kernel when triggered through DAMON tooling, but gives no CVSS score and no evidence of active exploitation.

Executive priority

Treat as a kernel stability and local privilege-bound risk until more severity data is available. Patch affected Linux fleets through normal kernel update channels, prioritizing systems where privileged users or automation can configure DAMON.

Technical view

DAMON core used damos_quota_goal->nid for NODE_DATA() in node_memcg_used_bp and node_memcg_free_bp without validating the node ID. Invalid values could cause out-of-bounds memory access. The fix validates the node ID and returns safe default ratios for invalid input.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions where users can configure DAMON quota goals. The source example uses privileged DAMON user-space tooling, but the record does not fully define required privileges or configurations.

Exploitation context

The source says the issue can be triggered with DAMON user-space tooling. KEV is false, and the bundle provides no cited evidence of active exploitation, public weaponization, or remote exploitation.

Researcher notes

The record lacks CVSS, CWE, and detailed privilege requirements. The key root cause is missing validation before NODE_DATA() use. Analysis should focus on affected kernel branches, backport status, and whether local DAMON control is available.

Mitigation direction

  • Update to a Linux kernel build containing the referenced stable fixes.
  • Verify downstream distribution kernels include the DAMON node ID validation fix.
  • Follow Linux distribution or vendor advisories for backported fixed packages.
  • Prioritize systems where DAMON tooling or configuration access is available.

Validation and detection

  • Inventory Linux kernel versions against the affected versions in the CVE record.
  • Check kernel changelogs or source for the referenced stable commits.
  • Review whether DAMON user-space tooling is installed or used on exposed systems.
  • Confirm DAMON quota goal handling rejects invalid node IDs after update.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46067 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb74a120bcf50787e5b9a2c3dcff999f9836ce1db, b74a120bcf50787e5b9a2c3dcff999f9836ce1dbunaffected
LinuxLinux6.19, 0, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.