CVE-2026-68164

A flaw was found in the Linux kernel's DAMON (Data Access MONitor) subsystem. The damon_set_regions() function, responsible for setting memory monitoring regions, incorrectly processes unsorted or overlapping input ranges due to a missing validation check. This can lead to unexpected behavior in DAMON and DAMOS (DAMON Operation Schemes), including incorrect monitoring results and repeated actions. More critically, it can result in the creation of negative-sized memory regions, potentially causing a division-by-zero error in damon_merge_two_regions(), leading to a system crash.

This issue affects systems using the DAMON memory monitoring subsystem via sysfs. Without validation, overlapping or unsorted region inputs can produce negative-sized regions and potentially trigger division-by-zero in damon_merge_two_regions(). Systems not using DAMON are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.