CVE-2026-89796

A flaw was found in the Linux kernel's DAMON (Data Access MONitor) core component. An integer overflow vulnerability in the kdamond_merge_regions() function, specifically during the calculation of a merge threshold, can lead to an infinite loop. This issue occurs under an unreasonable user setup involving large aggregation intervals or a high number of non-contiguous memory regions. A local user could potentially trigger this condition, resulting in a Denial of Service (DoS) due to system unresponsiveness.

This vulnerability is rated as Low severity because exploiting it requires local administrative privileges to configure the kernel's Data Access Monitoring (DAMON) subsystem, as well as an extreme, unrealistic parameter setup. In standard Red Hat Enterprise Linux environments, DAMON is inactive by default and must be explicitly configured through privileged interfaces. Consequently, unprivileged actors cannot trigger the condition, restricting potential denial-of-service impact to scenarios involving highly abnormal administrative settings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.