The Linux kernel’s damon_mtier sample module may raise a WARN_ONCE when enabled before the node start and end addresses are initialized because the module does not validate the address range parameters early. While the warning itself is not necessarily fatal, it can lead to kernel instability or a loss of functionality for the module. Based on the description, it is inferred that there is no known path for remote code execution or data disclosure, as the vulnerability is confined to the module’s internal state.

All Linux kernel builds that include the damon mtier sample module and are compiled without the DAMON_DEBUG_SANITY sanity check are impacted. The issue is present in any kernel version where the module is enabled before the memory node addresses are fully set up. Systems that deploy this module without ensuring correct load timing or without the validation fix are vulnerable.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score remains below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low exploitation probability. A local attacker with kernel module installation or sysfs write privileges can trigger the warning by enabling the module prematurely. The likely attack vector is inferred as local, requiring privileged access, and there are no known publicly available exploitation tools. The risk is limited to local system stability or a minor denial of service, with no remote impact.