---
id: CVE-2026-68165
title: 'mm/damon/core: validate ranges in damon_set_regions()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/damon/core: validate ranges in damon_set_regions()

  DAMON core logic assumes zero length regions don't exist.  However, a few
  DAMON API callers including DAMON_SYSFS…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 <
    71cf8a3ee1c18cfa8b88cc14bac9c2f43dd29f9b
  - >-
    Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 <
    b585facbafbb5cf117b37b1c75819ac046646c27
  - >-
    Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 <
    c927b73a5694c735314ea10e7c81c07f9bd51ad7
  - >-
    Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 <
    4b6f1d6d5d07855bd1bb9e64922b049062138bfa
  - >-
    Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 <
    43aaddd0fa92010a68adeda7744c7cf497a1c8e9
  - >-
    Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 <
    1292c0ecb1caefb8ca064a3639d5673991e8810c
  - Linux 5.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:43:25.650452Z'
published: '2026-08-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:59.951Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68165'
references:
  - url: 'https://git.kernel.org/stable/c/71cf8a3ee1c18cfa8b88cc14bac9c2f43dd29f9b'
  - url: 'https://git.kernel.org/stable/c/b585facbafbb5cf117b37b1c75819ac046646c27'
  - url: 'https://git.kernel.org/stable/c/c927b73a5694c735314ea10e7c81c07f9bd51ad7'
  - url: 'https://git.kernel.org/stable/c/4b6f1d6d5d07855bd1bb9e64922b049062138bfa'
  - url: 'https://git.kernel.org/stable/c/43aaddd0fa92010a68adeda7744c7cf497a1c8e9'
  - url: 'https://git.kernel.org/stable/c/1292c0ecb1caefb8ca064a3639d5673991e8810c'
tags:
  - cve.org
epss: 0.00211
epssPercentile: 0.11438
ingestedAt: '2026-11-06T16:57:43.140Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: validate ranges in damon_set_regions()

DAMON core logic assumes zero length regions don't exist.  However, a few
DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT
allow users to set empty monitoring target regions.  This could result in
WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and
divide-by-zero from damon_merge_two_regions().

For example, the WANR_ONCE() can be triggered like below.

    # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r)
    # CONFIG_DAMON_DEBUG_SANITY=y
    # damo start
    # cd /sys/kernel/mm/damon/admin/kdamonds/0
    # echo 0 > contexts/0/targets/0/regions/0/start
    # echo 0 > contexts/0/targets/0/regions/0/end
    # echo commit > state
    # dmesg
    [....]
    [   73.705780] ------------[ cut here ]------------
    [   73.707552] start 0 >= end 0
    [   73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758
    [...]

All DAMON API callers eventually use damon_set_regions() to setup the
regions.  Add the validation logic in the function.

## Affected

- `Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 < 71cf8a3ee1c18cfa8b88cc14bac9c2f43dd29f9b`
- `Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 < b585facbafbb5cf117b37b1c75819ac046646c27`
- `Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 < c927b73a5694c735314ea10e7c81c07f9bd51ad7`
- `Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 < 4b6f1d6d5d07855bd1bb9e64922b049062138bfa`
- `Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 < 43aaddd0fa92010a68adeda7744c7cf497a1c8e9`
- `Linux >= 43b0536cb4710e7bb591edfda7e68a1c327a3409 < 1292c0ecb1caefb8ca064a3639d5673991e8810c`
- `Linux 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.