When the DAMON subsystem fails to start, the context allocated by damon_stat_build_ctx() is not freed and the global damon_stat_context pointer remains stale. This creates a memory leak that can accumulate over time, potentially exhausting system memory and causing a denial‑of‑service condition. The flaw is classed as CWE‑772, describing an unreleased resource that leads to a memory leak.

The vulnerability resides in the mm/damon/stat module of the Linux kernel. All kernel releases that include the DAMON subsystem before the upstream patches that add the leak fix are affected. The vendor is Linux and the product is the Linux kernel.

No CVSS score or EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to be local or requiring elevated privileges, as the attacker would need to trigger damon_start to fail repeatedly in kernel space. While no published exploitation evidence exists, a local or privileged attacker could induce the failure and provoke the memory leak, raising the risk for environments that heavily rely on DAMON or where memory resources are critical.