Improper input validation in Linux kernel - CVE-2026-68164

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU142151

Improper input validation in Linux kernel - CVE-2026-68164

Published: August 12, 2026


Vulnerability identifier: #VU142151
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68164
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in damon_set_regions() when processing overlapping input ranges. A local user can provide overlapping or invalid address ranges to trigger a division by zero and cause a denial of service.

The issue can also lead to unexpected DAMON and DAMOS behavior, including malformed monitoring results and repeated application of actions to overlapping regions.


Affected software

Linux kernel
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)

How to mitigate CVE-2026-68164

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1

External References

Related Security Bulletins