In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: error out for >10000 active_mem_bp damos_quota_score() can… (CVE-2026-74645)
A vulnerability in the Linux kernel's DAMON_LRU_SORT module allows a division by zero error when the active_mem_bp parameter is set above 10000. This occurs because the cold memory scheme's quota target value can become zero, leading to a kernel crash. The issue requires write permission to module parameters and is mitigated by rejecting values greater than 10000 for active_mem_bp.
AI Analysis
Technical Summary
The Linux kernel's DAMON_LRU_SORT feature lets users configure memory quota targets via the active_mem_bp parameter. If active_mem_bp is set to a value greater than 10000 (e.g., 10002), the cold memory scheme's quota target is calculated as '10000 - active_mem_bp + 2', which can result in zero. This zero value causes a division by zero error in the damos_quota_score() function, leading to a kernel crash (Oops). The vulnerability is addressed by returning an error when a user attempts to start DAMON with an active_mem_bp value exceeding 10000, preventing the division by zero condition.
Potential Impact
Exploitation of this vulnerability can cause a kernel crash due to a division by zero error, resulting in a denial of service condition. The issue requires write access to module parameters to trigger, limiting the attack surface. There is no indication of code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix is available that prevents setting the active_mem_bp parameter to values greater than 10000 by returning an error. Users should ensure their Linux kernel includes this fix or avoid setting active_mem_bp above 10000. Since the vulnerability requires module parameter write permissions, restricting access to these parameters also mitigates risk.
In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: error out for >10000 active_mem_bp damos_quota_score() can… (CVE-2026-74645)
Description
A vulnerability in the Linux kernel's DAMON_LRU_SORT module allows a division by zero error when the active_mem_bp parameter is set above 10000. This occurs because the cold memory scheme's quota target value can become zero, leading to a kernel crash. The issue requires write permission to module parameters and is mitigated by rejecting values greater than 10000 for active_mem_bp.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's DAMON_LRU_SORT feature lets users configure memory quota targets via the active_mem_bp parameter. If active_mem_bp is set to a value greater than 10000 (e.g., 10002), the cold memory scheme's quota target is calculated as '10000 - active_mem_bp + 2', which can result in zero. This zero value causes a division by zero error in the damos_quota_score() function, leading to a kernel crash (Oops). The vulnerability is addressed by returning an error when a user attempts to start DAMON with an active_mem_bp value exceeding 10000, preventing the division by zero condition.
Potential Impact
Exploitation of this vulnerability can cause a kernel crash due to a division by zero error, resulting in a denial of service condition. The issue requires write access to module parameters to trigger, limiting the attack surface. There is no indication of code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix is available that prevents setting the active_mem_bp parameter to values greater than 10000 by returning an error. Users should ensure their Linux kernel includes this fix or avoid setting active_mem_bp above 10000. Since the vulnerability requires module parameter write permissions, restricting access to these parameters also mitigates risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pq4x-2prc-39cr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-74645"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8a27f2acd9273b499bc800
Added to database: 08/22/2026, 22:51:30 UTC
Last enriched: 08/22/2026, 23:53:24 UTC
Last updated: 08/23/2026, 00:52:02 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.