CVE-2024-50270: mm/damon/core: avoid overflow in damon_feed_loop_next_input()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-19 · updated 2026-06-17
Weakness: CWE-190

Description

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid overflow in damon_feed_loop_next_input() damon_feed_loop_next_input() is inefficient and fragile to overflows. Specifically, 'score_goal_diff_bp' calculation can overflow when 'score' is high. The calculation is actually unnecessary at all because 'goal' is a constant of value 10,000. Calculation of 'compensation' is again fragile to overflow. Final calculation of return value for under-achiving case is again fragile to overflow when the current score is under-achieving the target. Add two corner cases handling at the beginning of the function to make the body easier to read, and rewrite the body of the function to avoid overflows and the unnecessary bp value calcuation.

Affected products

Linux kernel: from 6.8 before 6.11.8; 6.12-rc1, 6.12-rc2, 6.12-rc3, 6.12-rc4, 6.12-rc5, 6.12-rc6 — fixed in 6.11.8

How to fix

Upgrade to a fixed version: Linux kernel 6.11.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-50270 or the next vulnerability affects your stack