CVE-2025-40229

The Linux kernel's DAMON (Data Access Monitoring) subsystem provides a function damon_destroy_scheme() to destroy a monitoring scheme. The function correctly freed the scheme's filter list but did not free the ops_filter field, leaving it allocated and causing a potential memory leak when the scheme is destroyed [1].

This vulnerability can be triggered by any local user capable of creating and destroying DAMON schemes, which typically requires the CAP_SYS_ADMIN capability or similar privileges. By repeatedly allocating and destroying schemes, an attacker can cause kernel memory exhaustion, leading to a denial-of-service condition.

The impact is limited to resource exhaustion; no privilege escalation or information disclosure has been associated with this issue. The memory leak can degrade system performance and eventually cause instability.

The Linux kernel developers have addressed the issue by ensuring that both filter and ops_filter are properly freed in damon_destroy_scheme(). The fix has been backported to stable kernels as seen in commits [1] and [2]. Users are advised to update to the latest kernel versions to mitigate this vulnerability.