CVE-2026-89796— 内核DAMON模块死循环漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，以下漏洞已得到修复： mm/damon/core：避免 kdamond_merge_regions() 中的无限内部循环 补丁系列：“mm/damon：针对无限循环、NULL 解引用和竞态条件的非紧急修复”，版本 v1.1。 Sashiko 在 DAMON 中发现了一些可能导致无限循环、NULL 解引用以及监控结果退化的问题。前两个问题听起来令人担忧，但无限循环仅在极不合理的用户配置下才会发生。NULL 解引用仅存在于单元测试中。监控结果的退化影响较小，因为它只涉及最佳努力（best-eff
可能的 ATT&CK 技术 1 AI
T1059 · Command and Scripting Interpreter影响版本矩阵 21
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 1e865019cef354a5f0314491b4b4fc9f9a613642< 407da1dd7f48e5ba22ceb8834f6923390632d025 |
affected |
d7eda72e59bbf3ed592db7ff0fd8c246c73149a8< 65edd8b3a88278c9f8e5c7d8c15d4f296ce35078 |
affected | ||
11078e2d11465518a9e85096bd28f8cd5fa1ea41< 5b0953f86d65855dc901050f40bbe6da0475d198 |
affected | ||
310d6c15e9104c99d5d9d0ff8e5383a79da7d5e6< 769c16699c89811386eb003c8fd9dcb8d405b316 |
affected | ||
310d6c15e9104c99d5d9d0ff8e5383a79da7d5e6< 50a7a5aec1aa43efc297fd4377c1cbdc7d15620d |
affected | ||
310d6c15e9104c99d5d9d0ff8e5383a79da7d5e6< 8a96a06e04d210845be5d9581c0e9e338947e8f8 |
affected | ||
310d6c15e9104c99d5d9d0ff8e5383a79da7d5e6< 123e4619ab6c8ab1c4cb1d7a58311a2af13929cd |
affected | ||
f2bd3184b6aeca6a497394b558337246e09fc02d |
affected | ||
| … +13 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-89796 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and
races", v1.1.
Sashiko found a few issues in DAMON that could cause infinite loop, NULL
dereference and monitoring results degradation. The first two sounds
scary but the infinite loop happens only under unreasonable user setup.
The NULL dereference is only in a unit test. Monitoring results
degradation is trivial since it is only best-effort, and those happens
from only unlikely races. Still those are bugs that better to fix if
possible. Fix those.
This patch (of 6):
Due to online parameter update like events, the number of DAMON regions
could be higher than the user-set upper limit. kdamond_merge_regions()
repeats merge regions until the number meets the limit, while doubling the
merge threshold up to the theoretical maximum threshold. It is tried only
up to the theoretical maximum threshold because even the aggressive
merging can fail from reducing the number of regions under the
user-defined upper limit. For example, there could be many user-defined
non-contiguous regions that cannot be merged.
The threshold based loop break condition is evaluated by comparing the
threshold for the next merging try against the theoretical maximum
threshold. If max_thres is larger than UINT_MAX / 2, doubling the
threshold could make it overflow, and bypass the loop break condition. In
the case, if the number of regions cannot be reduced under the upper limit
like explained above, the loop will run infinitely.
Prevent the case by doing the break condition check before doubling the
threshold. Also, prevent the threshold exceeding the maximum threshold,
as it could overflow and apply the wrong merge threshold.
This issue is unlikely to occur in real world, since having the max_thres
higher than UINT_MAX / 2 require unrealistically large aggregation
intervals compared to the sampling interval. Also, it requires an
unrealistically large number of uncontiguous regions setup. Nonetheless,
the consequence is bad and the fix is simple.
The issue was discovered [1] by Sashiko.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-89796 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-89796 的情报信息
请登录查看更多情报信息。
CVE-2026-89796 补丁与修复 (3)
CVE-2026-89796 其他参考 (4)
同批安全公告 · Linux · 2026-09-16 · 共 276 条
| CVE-2026-90048 | 9.8 CRITICAL | Linux内核NTFS3文件系统越界写漏洞 |
| CVE-2026-90012 | 9.8 CRITICAL | SPI DMA映射所有权修复 |
| CVE-2026-89970 | 9.8 CRITICAL | NVM Target SQ拆除时超时工作未同步 |
| CVE-2026-89857 | 9.8 CRITICAL | QLogic qla2xxx NVMe LS拒绝竞态条件漏洞 |
| CVE-2026-89969 | 9.8 CRITICAL | Linux内核 nvmet-tcp 越界写入漏洞 |
| CVE-2026-89847 | 9.8 CRITICAL | qla2xxx SCSI驱动异步IOCB超时双重完成漏洞 |
| CVE-2026-89972 | 9.8 CRITICAL | NVMe驱动错误路径SRCU宽限期缺失漏洞 |
| CVE-2026-89990 | 9.8 CRITICAL | Ceph ceph_mds_check_access 互斥锁缺失漏洞 |
| CVE-2026-90036 | 9.8 CRITICAL | Linux NFSd 阻塞锁收割时释放后使用漏洞 |
| CVE-2026-90038 | 9.8 CRITICAL | Linux内核NFSD导出撤销后使用漏洞 |
| CVE-2026-90037 | 9.8 CRITICAL | Linux内核NFSD close_lru释放后使用漏洞 |
| CVE-2026-89788 | 9.8 CRITICAL | Linux kernel ksmbd 释放后使用漏洞 |
| CVE-2026-89783 | 9.8 CRITICAL | Linux内核 xfrm6 越界写入漏洞 |
| CVE-2026-90042 | 9.8 CRITICAL | Ceph 虚拟内存分配缓冲区文件名解密漏洞 |
| CVE-2026-89778 | 9.8 CRITICAL | isofs 空 zisofs 块页面数组越界访问漏洞 |
| CVE-2026-89915 | 9.3 CRITICAL | KVM arm64 移除虚拟机级 VNCR 映射计数器 |
| CVE-2026-90049 | 9.3 CRITICAL | 内核网络子系统中skb_zerocopy处理中的缺陷 |
| CVE-2026-89775 | 9.3 CRITICAL | KVM arm64 VNCR TLB大小计算漏洞 |
| CVE-2026-89916 | 9.3 CRITICAL | KVM arm64 VNCR失效重试漏洞 |
| CVE-2026-89930 | 9.3 CRITICAL | KVM嵌套虚拟化本地TLB刷新漏洞 |
显示前 20 条，共 276 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-89796
暂无评论