CVE-2025-40229: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40229 is a memory leak vulnerability in the Linux kernel's DAMON (Data Access MONitor) subsystem, specifically in the mm/damon/core component. The flaw exists in the damon_destroy_scheme() function, which cleans up the filter list but fails to free the ops_filter field, resulting in a potential memory leak when a DAMON scheme is destroyed. It was published on December 4, 2025, and affects Linux kernel versions from commit ab82e57981d0 up to (but not including) the fix commits. The CVSS base score has not been formally assigned as of the time of this report, and the EPSS score is approximately 0.024% (Feedly).

The root cause is classified as a missing resource release (CWE-401: Missing Release of Memory after Effective Lifetime). In damon_destroy_scheme(), the function iterates over and frees entries in the filter list but neglects to also free the ops_filter structure, leaving allocated memory unreachable after the scheme object is destroyed. The fix, applied in two stable kernel commits (ff8dcf621a41 and 7071537159be), ensures both filter and ops_filter are properly freed during scheme teardown. Exploitation of this class of vulnerability typically requires local access and the ability to create and destroy DAMON schemes repeatedly (Feedly, Linux Kernel Git).

The primary impact of this vulnerability is a gradual exhaustion of kernel memory (availability impact) on affected Linux systems. Repeated creation and destruction of DAMON schemes without proper cleanup of ops_filter can cause kernel memory to leak over time, potentially leading to system instability or denial of service in long-running environments. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-40229. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with DAMON functionality enabled and the ability to repeatedly trigger scheme creation and destruction (Feedly).

The Linux kernel maintainers have released patches addressing this issue in two stable commits: ff8dcf621a4172f4a6d42cbbb25d21659d3ac300 (targeting the 6.17.x stable branch) and 7071537159be845a5c4ed5fb7d3db25aa4bd04a3 (targeting the 6.18 release). Fixed versions include Linux kernel 6.17.6 and 6.18. Users should update to a patched kernel version as soon as it is available from their distribution. As a workaround, disabling DAMON functionality (if not required) can reduce exposure, though upgrading is the recommended remediation (Feedly, Linux Kernel Git).