The vulnerability lies in the Linux kernel function most_register_interface. When registration of a device interface fails early, the routine returns an error without releasing the memory it allocated for the interface, leading to a resource leak. This flaw can accumulate over repeated failures, potentially exhausting system memory, degrading performance, or culminating in a denial‑of‑service condition. The weakness reflects classic resource‑management vulnerabilities.

All Linux kernel builds containing the unpatched most_register_interface function are affected. The patch was introduced in a series of commits referenced in the advisory; any kernel version shipped before those commits is vulnerable. The advisory does not specify particular kernel releases, so the impact applies to any kernel lacking the fix.

Because the leak is triggered only when most_register_interface fails early, a direct exploitation vector is limited. The CVSS score of 5.5 indicates medium severity, while an EPSS score of less than 1% signals a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The risk primarily materializes over time through memory exhaustion, especially in environments that frequently experience this error path. Monitoring and patching are therefore the most effective mitigations.