The vulnerability arises when the DAMON subsystem accepts an unchecked node identifier from the damos_quota_goal structure used by node_mem_{used,free}_bp quota goals. That identifier is then passed directly to si_meminfo_node() and NODE_DATA() without validation, triggering an out‑of‑bounds memory access that can culminate in a kernel crash or a NULL‑pointer dereference. The flaw is a CWE‑1285 issue.

All Linux kernel releases containing the DAMON memory‑control subsystem and exposing node_mem_{used,free}_bp quota goals to privileged users are vulnerable. Distributions running a kernel version that has not incorporated the "mm/damon/core: validate damos_quota_goal->nid" patch remain exposed regardless of distribution release.

The flaw requires local privilege; an attacker must already have root or a trusted process to invoke DAMON tools or the sysfs interface. No public exploits have been documented, the EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, its out‑of‑bounds nature gives it a high impact potential for privilege escalation if the attacker can supply a malicious node id.