The Linux kernel contains a flaw in mm/damon/stat where the damon_ctx object allocated by damon_stat_start() is not properly freed when damon_call() fails. This oversight allows the context to leak memory after the user re‑enables the feature, and if the object were to be freed prematurely the kdamond process could later access the freed memory leading to a use‑after‑free condition. The consequence is a kernel memory leak that can culminate in kernel instability or a local denial of service if the attacker can repeatedly allocate and fail to trigger the cleaner. The weakness is classified as CWE‑416 (Use‑After‑Free) and CWE‑772 (resource leak).

This issue affects the Linux kernel in releases 6.17 and all 7.0 release candidates (rc1 through rc7). It is therefore relevant to any distribution that ships one of these kernel versions or later until the vendor applies the fix.

The CVSS score of 7.8 reflects moderate to high severity, while the EPSS score of less than 1% indicates that exploitation is unlikely to be observed in the wild but is still possible. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. The likely attack vector is local; an attacker with kernel‑level privileges can cause the allocation and subsequent failure to trigger the memory leak or potential use‑after‑free, leading to a denial of service or further kernel compromise if combined with other local vulnerabilities.