Linux Kernel EUVD-2026-35434

Exploitation requires an existing local session with low-privilege credentials on the target system (CVSS PR:L, AV:L). The Linux kernel must have been compiled with CONFIG_DAMON_SYSFS enabled, and the DAMON sysfs interface at /sys/kernel/mm/damon/ must be writable by the attacker's user context - on most distributions, this path is root-only by default, meaning exploitation is blocked unless an administrator has explicitly opened sysfs permissions or a privilege escalation has already occurred. DAMON must not already be in a running state when the malformed value is supplied. The kernel version must fall within the affected range (post-d8f867fa0825 and pre-fix commits). Systems with CONFIG_DAMON_SYSFS=n, strict sysfs permissions, or running patched kernel versions are not exploitable.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat model: exploitation is limited to actors with existing local system access and write permission to the DAMON sysfs interface, dramatically narrowing the attacker population. EPSS of 0.02% (4th percentile) corroborates low exploitation likelihood, consistent with the local-only attack surface. There is no KEV listing and no public POC, so no public exploit code exists at time of analysis. The sole impact is availability (A:H - kernel crash/panic), with zero confidentiality or integrity impact. Note: the 'Information Disclosure' tag supplied in the input data is inconsistent with the CVSS vector (C:N) and the description; it appears to be a tagging error. Real-world priority is low for most environments; elevated concern only in multi-tenant Linux systems, container hosts, or shared HPC clusters where untrusted local users can reach DAMON sysfs.

A local user with standard shell access on an affected Linux system writes a non-power-of-two value (e.g., 3 or 12288) to the min_region_sz sysfs attribute under /sys/kernel/mm/damon/, then triggers damon_start() via the sysfs interface. The kernel proceeds without validating alignment, resulting in unaligned region address arithmetic that triggers a kernel panic and system crash. No public POC exists, but the attack path is trivial given the bug's precise description in the upstream commit log.