CVE-2025-40228: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40228 is a memory safety vulnerability in the Linux kernel's DAMON (Data Access MONitor) sysfs interface, specifically in the mm/damon/sysfs subsystem. The flaw arises because a dynamically allocated damon_ctx object used for testing online DAMON parameter updates is used without checking for allocation failure, and is also leaked when the test succeeds. It was published on December 4, 2025, and affects Linux kernel versions from commit 4c9ea539ad59ec60676930dacee02b7adde2e0c0 up to the patched commits, with fixes included in kernel 6.17.6 and 6.18. No CVSS score has been assigned at this time (Feedly, ENISA EUVD).

The root cause is a missing allocation failure check (CWE-252: Unchecked Return Value / CWE-401: Memory Leak) in the DAMON sysfs interface's commit test path. When the kernel's mm/damon/sysfs code allocates a damon_ctx object to validate online parameter update inputs, it proceeds to use the pointer without verifying that the allocation succeeded, which can result in a NULL pointer dereference or invalid memory access. Additionally, when the test succeeds, the allocated object is not freed, resulting in a kernel memory leak. The fix returns an error immediately upon allocation failure and ensures proper deallocation on success (Feedly, Linux Kernel Stable).

Exploitation of this vulnerability could lead to invalid kernel memory access (NULL pointer dereference) or a kernel memory leak, potentially causing system instability or denial of service. Because the affected code path is in the kernel's memory management subsystem, repeated triggering of the memory leak could degrade system performance or exhaust kernel memory resources over time. The vulnerability requires local access to the DAMON sysfs interface, limiting its scope to users or processes with sufficient privileges to interact with that interface (Feedly).

There is no known public proof-of-concept exploit for CVE-2025-40228, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus (plugin 277636) and Qualys (QID 6032019) (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability. Users should update to Linux kernel version 6.17.6 or 6.18 (or later), which include the fixes at commits 5b3609d9b9650bdea0bfdf643e0ce57e1aed67fc and f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f. Linux distribution vendors (e.g., Red Hat, Ubuntu, SUSE) are expected to backport these fixes into their supported kernel packages; users should apply the latest kernel updates from their distribution. As a workaround, restricting access to the DAMON sysfs interface (e.g., via appropriate file permissions or disabling DAMON if not required) can reduce exposure (Feedly, Linux Kernel Stable).