A flaw in the Linux kernel’s DAMON subsystem allows an attacker to supply an arbitrary node identifier to the damos_quota_goal parameter. The kernel code does not validate this identifier before using it in the node_memcg_used_bp and node_memcg_free_bp calculations, which can provoke an out-of-bounds memory access that crashes the kernel. The resulting kernel panic can be triggered using the DAMON user‑space tool, leading to denial of service.

All Linux kernel versions that contain the DAMON subsystem and lack the patch that validates damos_quota_goal->nid. The vulnerability applies to standard Linux distributions that ship the kernel without the fix, regardless of vendor.

Because no EPSS score is available and the vulnerability is not listed in CISA KEV, precise exploitation likelihood is unknown; however, the high impact of a kernel crash and the ability to trigger it via the user‑space DAMON tool lower the threshold for attackers. The exploitation path requires attacker control over the DAMON tool or the ability to set the damos_quota_goal, which can be achieved in environments where the tool is run with elevated privileges. The lack of a public CVSS score means the severity is not quantified, but the described out-of-bounds access warrants urgent attention.