The vulnerability occurs in the Linux kernel DAMON sysfs component where the repeat_call_control structure is not freed if damon_call() fails. This leakage can accumulate over time, gradually consuming kernel memory and potentially exhausting available memory resources. The impact is limited to a denial of service scenario because the attacker cannot read or modify data, but long‑term memory exhaustion can bring the system to a halt. The weakness is a classic case of missing release of memory after its effective use (CWE-772).

All Linux kernel versions that implement DAMON sysfs, specifically kernel releases 6.17 and all canary releases of kernel 7.0 prior to the inclusion of the patch. Because the kernel identifies the vendors as Linux:Linux, any distribution shipping these kernel versions is affected until a corrected build is issued.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of <1% suggests that exploitation is unlikely in the near term. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to provoke damon_call() failures repeatedly, such as by rapidly terminating monitored virtual address processes, to gradually leak memory. Without a direct remote code execution vector, the threat is primarily a resource exhaustion attack and requires long‑term persistence to result in a system outage.