The kernel function responsible for iterating over memory cgroups mistakenly exits the loop without invoking the required cleanup call, which leaves an incremented reference to the cgroup unreleased. The description indicates a memory reference leak but does not enumerate further observable consequences beyond the retention of the reference. This defect could theoretically increase memory usage over time if the leak persists in a long‑running kernel.

Linux kernel builds that have not incorporated the commit adding the missing mem_cgroup_iter_break() call are impacted. Any distribution or custom kernel that contains the unpatched iteration logic in the damon_sysfs_memcg_path_to_id() path is vulnerable.

The CVSS score of 5.5 reflects moderate severity, and the EPSS score is less than 1 %, indicating a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require code execution in the kernel or the ability to trigger the faulty iteration path, which typically demands elevated privileges; thus the attack vector is presumed local and not remotely exploitable based on the supplied data.