The vulnerability resides in the Linux kernel's DAMON subsystem. Incorrect handling of monitoring intervals can trigger a divide‑by‑zero in damon_max_nr_accesses and an out‑of‑bounds write in damon_hot_score. These errors culminate in a kernel Oops, which may expose the system to local denial of service by corrupting kernel state. The weakness is a classic divide‑by‑zero and array‑index error, as reflected by the relevant CWE identifier.

All Linux kernel builds prior to the inclusion of the fix commit (35d4a3cf70a855b50e53189ac2f8463e20a02046) are affected. Any system that has enabled DAMON via sysfs and may configure sample_us or aggr_us intervals, including zero or excessively high values, is vulnerable. Vendors should check their kernel release notes for the corresponding patch and verify that no such voting intervals are left at zero or unbounded values.

The EPSS score is reported as less than 1 %, indicating a very low, but non‑zero, probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog at present. The likely attack vector is local; an attacker must have the ability to write to the DAMON sysfs interface. Based on the description, it is inferred that such write permissions are typically restricted to root. The flaw causes a kernel crash, leading primarily to denial of service and possible system instability. No evidence of privilege escalation is provided.