The vulnerability arises when the DAMON sysfs interface reads and writes the path value. A write operation frees the buffer that holds the path but is not protected by damon_sysfs_lock, so a concurrent user read that operates on a different file descriptor can see the freed memory, resulting in a kernel user-after‑free. This can cause kernel memory corruption, a crash, or information leakage. The flaw stems from a double‑free and subsequent use‑after‑free, which fall under CWE-415 and CWE-413 respectively. The text does not state privilege escalation, and therefore that outcome is not explicitly supported.

Linux kernel versions that ship the DAMON sysfs path implementation without the damon_sysfs_lock protection are affected. The CVE does not specify a version range, but any kernel containing the original damon_sysfs_path code before the referenced commits is vulnerable.

The flaw is a local kernel use‑after‑free that requires a user able to write to the DAMON sysfs "path" attribute and a race between a write and a read on separate file descriptors. Because the vulnerability is characterized as a double‑free (CWE‑415) followed by a use‑after‑free (CWE‑413), the potential for kernel memory corruption is significant. The CVSS score of 7.8 categorizes the issue as high severity. Exploitability is moderate due to this race condition, but the impact is high because of kernel memory corruption. The EPSS score is <1% and the vulnerability is not listed in CISA KEV, indicating limited known exploitation, yet systems exposing the DAMON sysfs interface to non‑privileged users pose a significant risk.