The flaw lies in a Linux kernel sample module that accepts address range parameters without adequate validation. When the module is loaded before node addresses have been initialized, a kernel warning is triggered, indicating that start and end addresses are invalid. This lack of input validation can allow an attacker to influence kernel behavior, potentially causing a module failure or, in worst cases, a kernel panic. The weakness corresponds to improper input validation.

Affected systems include any Linux kernel configuration that enables the damon mtier sample module. The issue is present in all kernel versions where the module has not yet been patched to verify address ranges, regardless of specific kernel release numbers provided in the advisory.

EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, implying a low to moderate risk level. The CVSS score is not disclosed; hence the severity cannot be precisely quantified. The likely attack vector is local: an attacker with permission to load kernel modules or write to sysfs attributes could supply invalid parameters. Exploitation would result in a kernel warning and possible denial of service, but no known remote code execution or data disclosure is described.