The vulnerability occurs when the damon_pa_migrate() or damos_va_migrate() routine isolates pages (folios) to a private list and then calls damon_migrate_pages(). If the target NUMA node is invalid, damon_migrate_pages() exits early and fails to return the isolated folios to the least‑recently‑used (LRU) list. The isolation step keeps an additional reference on each folio, so the pages remain outside the LRU and can stay pinned even after the mapping that created them is removed. Repeated migrations to an invalid node can therefore leave many orphaned folios, consuming kernel memory that is not released until the mapping is finally destroyed. Over time this manifests as a gradual depletion of usable memory, producing a denial‑of‑service‑like effect with performance degradation or crashes under memory pressure.

All systems running a Linux kernel that includes the DAMON memory‑monitoring subsystem are affected. The vendor list identifies the generic Linux kernel, meaning most distributions are impacted. No specific version information is supplied in the CVE data, so any kernel release containing the vulnerable damon_* code paths should be considered at risk until the patch is applied.

The CVSS score of 5.5 labels the issue as moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no widely deployed exploits are known. An attacker would need to trigger the invalid NUMA migration path, which typically requires local or privileged kernel context; a separate vulnerability that provides code execution or privilege escalation could be leveraged to induce the fault. In the absence of such an attacker advantage, the risk to ordinary systems remains low, but the potential for long‑term memory exhaustion warrants timely remediation.