In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()… (CVE-2026-98918)

The Linux kernel's DAMON subsystem had a vulnerability where damon_ptep_mkold() was called with a non-page-aligned address derived from a random byte within a sampled region. On arm64, changes to the contpte helper caused the page table walk range to be calculated based on this unaligned address, leading to clearing of PTE_AF bits beyond the intended block and writing past the end of the page table page. This out-of-bounds write could cause kernel crashes if the adjacent page was read-only or silent corruption if writable. The issue was detected by the kernel selftest suite on arm64. The remediation was to pass a page-aligned address to ptep_test_and_clear_young(), ensuring no out-of-bounds writes occur. The sampling address itself remains unchanged, preserving DAMON's semantics.

The vulnerability can cause kernel crashes or silent memory corruption on affected arm64 Linux kernels during DAMON sampling operations. Crashes occur if the out-of-bounds write hits read-only memory, while silent corruption may affect other kernel data structures if the adjacent page is writable. This undermines kernel stability and could potentially lead to privilege escalation or denial of service, though no specific exploit in the wild is known.

A fix is available that ensures the address passed to ptep_test_and_clear_young() is page-aligned, preventing out-of-bounds writes. Users should update to a Linux kernel version that includes this fix. No other mitigation is required as the vulnerability is resolved by this patch.