CVE-2026-52905

MediumCVSS 5.5/10Last modified Jul 23, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: disallow non-power of two min_region_sz on damon_start()

Commit d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") introduced a bug that allows unaligned DAMON region address ranges. Commit c80f46ac228b ("mm/damon/core: disallow non-power of two min_region_sz") fixed it, but only for damon_commit_ctx() use case. Still, DAMON sysfs interface can emit non-power of two min_region_sz via damon_start(). Fix the path by adding the is_power_of_2() check on damon_start().

The issue was discovered by sashiko [1].

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1284

Affected software

VendorProductVersions
LinuxLinux>= d8f867fa0825fb3e358457566d7326d8aab2406a, < 1de2db19a6028abe7d905875922faef5b873de67; >= d8f867fa0825fb3e358457566d7326d8aab2406a, < 89b6226b6c2a4add3939f361653a47c212d6ab75; >= d8f867fa0825fb3e358457566d7326d8aab2406a, < 95093e5cb4c5b50a5b1a4b79f2942b62744bd66a
LinuxLinux6.18

References

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-529067.7In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead of replaced Since commit CVE-2026-529077.8In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: fix off by one bugs Change these comparisons fCVE-2026-529087.8In the Linux kernel, the following vulnerability has been resolved: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible If IB_MR_CVE-2026-529097.8In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device. john1988 and NoamCVE-2026-52916.5Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive infCVE-2026-529107.8In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reporCVE-2026-529118.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope conn->binding slowpath to bound sessions only When the biCVE-2026-529127.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_uCVE-2026-529135.5In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: stop OGMv2 on disabled interface When a batadv_hard_ifaCVE-2026-529149.8In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keepsCVE-2026-529157.1In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_hbh: reject oversized option lists struct ip6t_opts stCVE-2026-529165.5In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: disallow unicast fragment in fragment batadv_frag_sk
CVE-2026-52905: Medium severity, CVSS 5.5 | Vulnix