The kernel function damos_walk() assigns a control structure to ctx->walk_control before verifying that the context is running. If the context is inactive, the function returns -EINVAL without clearing ctx->walk_control, leaving a dangling pointer to a stack‑allocated structure that will be freed when the caller returns. A stale walk_control pointer can lead to a use‑after‑free if the context is later started and the kernel dereferences the pointer during operations such as damos_walk_cancel(). Although the description notes that no callers start the context after the error, the flaw could still produce an erroneous EBUSY status when subsequent damos_walk() calls are made, as the stale pointer remains non‑NULL. Because the backing structure is on the stack, the actual damage is limited to the DAMON subsystem, but users may encounter confusing error codes while DAMON remains stopped.

The vulnerability occurs in the Linux kernel’s DAMON subsystem (dvfs/damon). All active Linux kernel releases that include DAMON – regardless of version number – are potentially affected. No specific vendor versions are listed, so the issue applies to any kernel build that has not yet incorporated the fix. Users running a kernel without the patch that clears ctx->walk_control before returning an error are at risk.

The exploitability of this flaw is low. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread or automated exploitation is currently known. Because the use‑after‑free scenario relies on a context that later becomes active after the error, and because DAMON is only used when explicitly started, an attacker would need privileged access to influence DAMON operation. The resulting error leaves DAMON unusable until it is restarted, which is a disruption rather than a traditional security breach. Overall, the risk can be considered moderate, with limited potential impact confined to DAMON service availability.