CVE-2025-40227: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40227 is a memory leak vulnerability in the Linux kernel's DAMON (Data Access MONitor) sysfs subsystem. The flaw occurs in mm/damon/sysfs where the damon_ctx object allocated for testing online DAMON parameter commit inputs is only deallocated upon test failure, causing a memory leak on every successful commit operation. It was published on December 4, 2025, and affects Linux kernel versions from commit 4c9ea539ad59ec60676930dacee02b7adde2e0c0 up to the patched commits. No CVSS score has been assigned; the EPSS score is approximately 0.026% (Feedly, ENISA EUVD).

The root cause is a missing deallocation path in the DAMON sysfs code (CWE-401: Missing Release of Memory after Effective Lifetime). When a user triggers an online DAMON parameter commit via the sysfs interface, a temporary damon_ctx is allocated for validation/testing purposes. The code only frees this context in the error path, so every successful commit leaks the allocated memory. The fix ensures the context is always deallocated regardless of the outcome, as reflected in the upstream kernel patches (Feedly, Kernel Patch 1, Kernel Patch 2).

The primary impact is a gradual memory leak in the Linux kernel, which can degrade system availability over time as kernel memory is exhausted through repeated DAMON parameter commits via sysfs. This could lead to system instability or denial of service on long-running systems where DAMON is actively used and parameters are frequently updated. There is no known confidentiality or integrity impact, and exploitation requires local access to the sysfs interface (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-40227. The vulnerability requires local access to trigger DAMON sysfs parameter commits, significantly limiting its attack surface. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The fix is included in Linux kernel stable releases patched at commits ba236520ae53418859f4b7c7de3c71478d3c0b5a and 139e7a572af0b45f558b5e502121a768dc328ba8, with patches targeting kernel 6.17.6 and 6.18. Users should update to a patched kernel version as provided by their Linux distribution. As a workaround, avoiding frequent online DAMON parameter commits via sysfs can reduce the rate of memory leakage until a patch is applied (Feedly, Kernel Patch 1, Kernel Patch 2).