The vulnerability resides in the Linux kernel's damon_set_regions() function, which assumes that submitted memory ranges are sorted by address and do not overlap. A recent commit removed the validation of this assumption, allowing callers to provide overlapping ranges. When such ranges are processed the logic can calculate negative sizes; the kernel then triggers WARN_ONCE if debug checks are enabled and, if the merging of overlapping regions continues, can perform a division by zero inside damon_merge_two_regions(), which will crash the kernel. The resulting failure can lead to an unexpected reboot or loss of availability. The issue is not a traditional remote flaw but directly leads to instability of the host system.

All Linux kernel releases that include the damon_set_regions() function and the associated sysfs interface are potentially impacted. No specific kernel version is listed, so any build that contains damon_set_regions() and the sysfs path for region modification remains vulnerable until the missing validation is restored by the upstream patch.

The CVSS score of 4.1 indicates a moderate severity, while the EPSS score of < 1% suggests a very low probability of exploitation in the wild. The issue is not listed in CISA's KEV catalog. Exploitation would require a local attacker to create or modify DAMON regions via the sysfs interface, which the kernel typically restricts to privileged users. Based on the description, the likely attack vector is a local privileged attacker, who could supply carefully crafted overlapping ranges to trigger the division-by-zero and cause a kernel crash. No public exploit code is known, but the flaw presents a clear denial-of-service route once the prerequisite of privileged access is satisfied.