CVE-2026-46067: mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp
Users can set damos_quota_goal->nid with arbitrary value for
node_memcg_{used,free}_bp. But DAMON core is using those for NODE-DATA()
without a validation of the value. This can result in out of bounds
memory access. The issue can actually triggered using DAMON user-space
tool (damo), like below.
$ sudo mkdir /sys/fs/cgroup/foo
$ sudo ./damo start --damos_action stat --damos_quota_interval 1s \
--damos_quota_goal node_memcg_used_bp 50% -1 /foo
$ sudo dmseg
[...]
[ 524.181426] Unable to handle kernel paging request at virtual address 0000000000002c00
Fix this issue by adding the validation of the given node id. If an
invalid node id is given, it returns 0% for used memory ratio, and 100%
for free memory ratio.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue lets an invalid DAMON quota goal node ID cause out-of-bounds memory access. The public record shows it can crash the kernel when triggered through DAMON tooling, but gives no CVSS score and no evidence of active exploitation.
Executive priority
Treat as a kernel stability and local privilege-bound risk until more severity data is available. Patch affected Linux fleets through normal kernel update channels, prioritizing systems where privileged users or automation can configure DAMON.
Technical view
DAMON core used damos_quota_goal->nid for NODE_DATA() in node_memcg_used_bp and node_memcg_free_bp without validating the node ID. Invalid values could cause out-of-bounds memory access. The fix validates the node ID and returns safe default ratios for invalid input.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions where users can configure DAMON quota goals. The source example uses privileged DAMON user-space tooling, but the record does not fully define required privileges or configurations.
Exploitation context
The source says the issue can be triggered with DAMON user-space tooling. KEV is false, and the bundle provides no cited evidence of active exploitation, public weaponization, or remote exploitation.
Researcher notes
The record lacks CVSS, CWE, and detailed privilege requirements. The key root cause is missing validation before NODE_DATA() use. Analysis should focus on affected kernel branches, backport status, and whether local DAMON control is available.
Mitigation direction
Update to a Linux kernel build containing the referenced stable fixes.
Verify downstream distribution kernels include the DAMON node ID validation fix.
Follow Linux distribution or vendor advisories for backported fixed packages.
Prioritize systems where DAMON tooling or configuration access is available.
Validation and detection
Inventory Linux kernel versions against the affected versions in the CVE record.
Check kernel changelogs or source for the referenced stable commits.
Review whether DAMON user-space tooling is installed or used on exposed systems.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-46067 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
3Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
May 27, 2026, 12:57 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.