Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: error out for >10000 active_mem_bp damos_quota_score() can… (CVE-2026-74645)

0
Medium
Published: 08/22/2026 (08/22/2026, 18:30:27 UTC)
Source: GCVE Database

Description

A vulnerability in the Linux kernel's DAMON_LRU_SORT module allows a division by zero error when the active_mem_bp parameter is set above 10000. This occurs because the cold memory scheme's quota target value can become zero, leading to a kernel crash. The issue requires write permission to module parameters and is mitigated by rejecting values greater than 10000 for active_mem_bp.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 08/22/2026, 23:53:24 UTC

Technical Analysis

The Linux kernel's DAMON_LRU_SORT feature lets users configure memory quota targets via the active_mem_bp parameter. If active_mem_bp is set to a value greater than 10000 (e.g., 10002), the cold memory scheme's quota target is calculated as '10000 - active_mem_bp + 2', which can result in zero. This zero value causes a division by zero error in the damos_quota_score() function, leading to a kernel crash (Oops). The vulnerability is addressed by returning an error when a user attempts to start DAMON with an active_mem_bp value exceeding 10000, preventing the division by zero condition.

Potential Impact

Exploitation of this vulnerability can cause a kernel crash due to a division by zero error, resulting in a denial of service condition. The issue requires write access to module parameters to trigger, limiting the attack surface. There is no indication of code execution or privilege escalation from the provided data.

Mitigation Recommendations

A fix is available that prevents setting the active_mem_bp parameter to values greater than 10000 by returning an error. Users should ensure their Linux kernel includes this fix or avoid setting active_mem_bp above 10000. Since the vulnerability requires module parameter write permissions, restricting access to these parameters also mitigates risk.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Osv Id
GHSA-pq4x-2prc-39cr
Osv Schema Version
1.4.0
Aliases
["CVE-2026-74645"]
Ecosystems
[]
Database Specific Severity
null
Cvss Version
null

Threat ID: 6a8a27f2acd9273b499bc800

Added to database: 08/22/2026, 22:51:30 UTC

Last enriched: 08/22/2026, 23:53:24 UTC

Last updated: 08/23/2026, 00:52:02 UTC

Views: 2

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses