This vulnerability arises in the Linux kernel's DAMON subsystem when a zero target_value is supplied to damos_commit_quota_goal(), causing a division-by-zero error. The core logic fails to validate this corner case, leading to an undefined operation that can crash the kernel or render the system unstable. If an attacker has the ability to invoke DAMON APIs, they could trigger a kernel OOPS or a denial‑of‑service by supplying a zero target value. The weakness is a typical divide‑by‑zero error that can be exploited if the affected interface is reachable from untrusted contexts.

The flaw affects all Linux kernel builds that include the DAMON feature, specifically those using the mm/damon implementation. The issue was addressed by patching the core layer and removing the defensive checks from individual API callers. Users operating recent kernels incorporating the mm/damon patch series have the fix; older kernels lacking this change remain susceptible.

No CVSS score or EPSS value is published for this CVE, and it is not listed in the CISA KEV catalog. However, the flaw can be triggered by any user with access to DAMON API calls, potentially leading to a kernel crash. The lack of external proof of exploitation suggests current risk may be moderate, but the absence of mitigations on many distributions means a vulnerable system could be compromised if an attacker can reach the API. Upgrading to a kernel that includes the patch is the recommended path to eliminate the risk.