The vulnerability arises when the DAMON subsystem fails to start; the allocated context is not released and a global pointer remains stale. This results in a memory leak that can accumulate, eventually exhausting system memory and creating a denial of service scenario. The flaw is a classic example of CWE‑401 (Memory Leak).

All Linux kernel releases that contain the DAMON subsystem before the listed commit amendments are affected. The issue exists in the kernel’s mm/damon/stat module and can impact any system running a version of the Linux kernel that has not yet incorporated the upstream patches. The specific vendor is Linux, and the product is the Linux kernel.

No CVSS score is provided, and the EPSS score is not available, so the exact severity and likelihood of exploitation have not been quantified. KEV does not list the vulnerability. The leak can be exploited by repeatedly invoking damon_start failures, which may require local kernel access or elevated privileges. While the attack vector is inferred to be local or privileged, the lack of published exploitation evidence suggests a lower but still noteworthy risk, especially in environments that use DAMON and where memory resources are critical.