When the HFS filesystem was migrated to the new mount API, a bug was introduced that incorrectly managed the allocation of sb->s_fs_info. If the superblock setup fails after allocation but before ownership is transferred by hfs_fill_super(), the allocated structure is never freed and a memory leak occurs. The object remains allocated in kernel memory, leading to gradual exhaustion of free memory with repeated failed mount attempts. The vulnerability does not directly provide code execution or data disclosure, but persistent leaks can degrade system stability over time.

The flaw affects all Linux kernel releases that include the HFS filesystem implementation. Since the CPE string references the entire Linux kernel and no specific version is listed, any kernel containing the buggy HFS mounting logic is potentially vulnerable.

The CVSS score of 5.5 classifies the issue as moderate, reflecting that the leak requires local action involving a failed mount operation. The EPSS score of <1% suggests exploitation is unlikely in the wild at the time of this analysis. The vulnerability is not currently listed in the CISA KEV catalog. The attack likely requires a user with the ability to trigger mount operations, potentially elevating privileges through repeated exhaustion, but no direct remote exploitation path is documented. The risk is increased for systems that mount HFS images frequently from untrusted sources or that operate under tight memory constraints.