The flaw in the Linux kernel’s DAMON subsystem causes a param_ctx allocation to leak when damon_sysfs_new_test_ctx() fails and can trigger a NULL pointer dereference if a privileged user performs an incorrect sequence of sysfs operations. This results in memory exhaustion or a kernel crash, potentially leading to denial of service.

The vulnerability affects all Linux kernel configurations that expose the DAMON sysfs interface. No specific kernel version range is listed, but the patch is part of the v4 series and applies to any release containing the offending code before the fix.

The EPSS score is unavailable and the issue is not listed in the CISA KEV catalog, indicating no known public exploits. Nonetheless, the defect can be abused by a local privileged user to trigger memory exhaustion or a crash. The lack of publicly available exploit code lowers the immediate risk, but the potential for system downtime warrants prompt remediation. The likely attack vector is a privileged local user manipulating the DAMON sysfs interface.