The vulnerability stems from an error path in the Linux kernel’s damon sysfs scheme initialization. When the creation of the tried_regions directory fails, the error handling incorrectly releases the reference to the stats directory instead of the intended directory. This mis‑release leaks the stats directory object and, more critically, if the tried_regions allocation itself failed, the scheme->tried_regions pointer remains uninitialized. The subsequent call to kobject_put on this uninitialized pointer dereferences invalid memory, which can cause a kernel crash or corruption. The impact is a denial of service at the kernel level and a potential vector for privilege escalation if the crash can be triggered by an attacker with sufficient privileges.

This bug affects the Linux kernel’s damon sysfs scheme implementation. No specific kernel release numbers are listed, so the issue applies to any kernel version where this code path is present and not yet patched.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% suggests that exploitation is considered unlikely in the wild. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. Based on the description, the likely attack vector is local or elevated privileges. Attackers would need local or elevated privileges to trigger the faulty error path, as the flaw occurs within kernel code handling the damon sysfs scheme. While the exploitability requires direct kernel access, a successfully triggered uninitialized pointer dereference could lead to a kernel crash, potentially resulting in a denial‑of-service or privilege escalation if control is achieved. The lack of publicly known exploits and low EPSS score combine to keep the immediate risk low, but the kernel crash risk still warrants timely patching.