In the Linux kernel’s DAMON subsystem, the function damon_apply_min_nr_regions repeatedly splits memory regions until each region meets a user‑defined lower bound. The split routine can silently fail when memory allocation for a new region is not possible. If the failure occurs while processing the last region in the list, the linked list traversal returns an invalid pointer, leading to an invalid memory dereference and corruption. Although the allocation is small and failures are rare, any occurrence would result in kernel memory corruption, which could compromise system integrity.

The vulnerability exists in all Linux kernels that include the damon_core implementation and have not yet incorporated the patch found in commit 463ebd63e8ee3d73022a18915ea43320dad8aad7. The affected vendor is Linux, and version information is not explicitly listed, so all current releases prior to the fix are considered vulnerable.

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of current exploitation. However, the impact—a potential kernel memory corruption—has severe and could allow privilege escalation or denial of service if an attacker can trigger the region‑split failure. Attackers would need local kernel access to influence DAMON operations or force an allocation failure. The likely attack vector is local kernel access to manipulate DAMON operations, inferred from the description. The severity remains low to medium pending exploitation evidence, but the damage scope is system‑wide if triggered.