Medium 5.5Published Oct 1, 2025

CVE-2025-39909mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()

Updated under an hour ago (Oct 27, 2026, 9:00 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() Patch series "mm/damon: avoid divide-by-zero in DAMON module's parameters application". DAMON's RECLAIM and LRU_SORT modules perform no validation on user-configured parameters during application, which may lead to division-by-zero errors. Avoid the divide-by-zero by adding validation checks when DAMON modules attempt to apply the parameters. This patch (of 2): During the calculation of 'hot_thres' and 'cold_thres', either 'sample_interval' or 'aggr_interval' is used as the divisor, which may lead to division-by-zero errors. Fix it by directly returning -EINVAL when such a case occurs. Additionally, since 'aggr_interval' is already required to be set no smaller than 'sample_interval' in damon_set_attrs(), only the case where 'sample_interval' is zero needs to be checked.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 40e983cca9274e177bd5b9379299b44d9536ac68 before 74e391f7da7d9d5235a3cca88ee9fc18f720c75b; 40e983cca9274e177bd5b9379299b44d9536ac68 builds before 7bb675c9f0257840d33e5d1337d7e3afdd74a6bf; from 40e983cca9274e177bd5b9379299b44d9536ac68 before af0ae62b935317bed1a1361c8c9579db9d300e70; from 40e983cca9274e177bd5b9379299b44d9536ac68 before 326a4b3750c71af3f3c52399ec4dbe33b6da4c26; from 40e983cca9274e177bd5b9379299b44d9536ac68 before 711f19dfd783ffb37ca4324388b9c4cb87e71363	CNA record
linux linux_kernel linux:linux_kernel	from 6.0 before 6.1.153; from 6.2 before 6.6.107; from 6.7 before 6.12.48; from 6.13 before 6.16.8; 6.17; 6.17; 6.17; 6.17; and 1 more ranges	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/74e391f7da7d9d5235a3cca88ee9fc18f720c75b	patch
https://git.kernel.org/stable/c/7bb675c9f0257840d33e5d1337d7e3afdd74a6bf	patch
https://git.kernel.org/stable/c/af0ae62b935317bed1a1361c8c9579db9d300e70	patch
https://git.kernel.org/stable/c/326a4b3750c71af3f3c52399ec4dbe33b6da4c26	patch
https://git.kernel.org/stable/c/711f19dfd783ffb37ca4324388b9c4cb87e71363	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.