CVE-2026-99240: 
Linux Debian Schwachstellenanalyse und -minderung

CVE-2026-99240 is a divide-by-zero vulnerability in the Linux kernel's DAMON (Data Access Monitoring) subsystem that can cause a kernel panic (denial of service). The flaw exists in the damos_commit_quota_goal() function, which fails to validate that a DAMOS scheme's quota goal target_value is non-zero before performing division operations. It affects Linux kernel versions prior to 6.18.60, 7.2.14, and 7.3.1. Disclosed on November 2, 2026, it carries a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-369 (Divide By Zero). When a DAMOS scheme is configured with a damos_quota_goal having a target_value of zero, the damos_commit_quota_goal() function in mm/damon/core.c performs a division using that zero value as the denominator, triggering a kernel panic. Previously, individual DAMON API callers (such as DAMON_LRU_SORT and DAMON_SAMPLE_MTIER) were each responsible for validating this parameter, making it easy to miss the check in new callers. The fix centralizes the validation in the core layer by having damos_commit_quota_goal() return an error when target_value is zero, with the fix applied via kernel commits d5482be6243b, cc190c4073f5, and 156aeda4d74e (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a kernel panic, causing a complete denial of service on the affected system. The impact is limited to availability — there is no confidentiality or integrity impact. An attacker must have local access and elevated privileges (typically root or equivalent) to configure DAMON DAMOS schemes via sysfs or the DAMON API, limiting the blast radius to systems where such access is granted to untrusted users (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access with high privileges (PR:H) to configure DAMON subsystem parameters, significantly limiting the attacker pool. No threat actor attribution has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No EPSS score data was available in the provided sources (GitHub Advisory, Red Hat Bugzilla).

1. Gain privileged local access: Obtain a local account with sufficient privileges to configure DAMON subsystem parameters (typically root or a user with CAP_SYS_ADMIN).
2. Access DAMON sysfs interface: Navigate to the DAMON sysfs interface, typically located under /sys/kernel/mm/damon/ or the relevant DAMON context path.
3. Configure a DAMOS scheme with a zero quota goal target_value: Create or modify a DAMOS scheme and set the quota_goal/target_value parameter to 0 (e.g., echo 0 > /sys/kernel/mm/damon/<context>/schemes/<scheme>/quota/goal/target_value).
4. Trigger the division-by-zero: Commit or activate the DAMOS scheme configuration, causing damos_commit_quota_goal() to execute a division by zero, resulting in a kernel panic and system crash (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing a divide-by-zero error in mm/damon/core.c or damos_commit_quota_goal().
• Logs: System crash dumps (kdump/vmcore) generated around the time of the incident, with stack traces pointing to the DAMON subsystem.
• File System: Unexpected writes to DAMON sysfs paths such as /sys/kernel/mm/damon/ with target_value set to 0.
• Process: Unusual privileged processes or scripts interacting with DAMON sysfs interfaces immediately before a system crash.

Apply the patched Linux kernel versions: 6.18.60 or later, 7.2.14 or later, or 7.3.1 or later, which include the fix in commits d5482be6243b, cc190c4073f5, and 156aeda4d74e. As a workaround, restrict access to DAMON configuration interfaces (sysfs paths) to trusted privileged users only, and implement input validation at the application level when using DAMON APIs to ensure quota_goal target_value is never set to zero (GitHub Advisory, Red Hat Bugzilla).