The Linux kernel networking module includes a memory leak (CWE‑401) in the skb_segment_list() function when handling packets aggregated by the Generic Receive Offload (GRO) engine. The function incorrectly subtracts the truesize of each fragment packet from the parent socket’s memory counter even though the fragments are no longer charged to the socket. This miscount causes sk_wmem_alloc to remain non‑zero after the socket is freed, preventing socket destruction and resulting in a persistent leak of kernel memory.

This flaw affects the Linux kernel, vendor Linux, specifically kernel versions 6.9 (including release candidates rc1 through rc7) and 6.19 (rc1 through rc4). Users should verify that their installed kernel contains the relevant code paths and has applied the fix that restores correct truesize handling in skb_segment_list() .

The likely attack vector is network traffic that causes the kernel's GRO engine to process packets, potentially triggered by an attacker sending specially crafted packets. The CVSS score is 5.5, indicating moderate severity, and the EPSS score is less than 1%, which suggests a very low probability of exploitation at any given time. The vulnerability is not listed in the CISA KEV catalog. The flaw does not provide direct code execution or immediate denial of service, but it may result in gradual kernel memory exhaustion if left unpatched.