A memory leak in the Linux idpf driver occurs when idpf_vc_core_deinit() fails to free the hw->lan_regs structure. The defect allows kernel memory allocations to remain after a reset and are reported by the kmemleak tool. Over time, the repeated allocation of these objects can exhaust kernel memory and destabilise the operating system, resulting in a denial‑of‑service condition. The flaw is a direct instance of CWE‑401, which is a classic memory management weakness.

The vulnerability applies to the mainline Linux kernel, specifically to kernel versions 6.17 and all 6.19 release candidates from rc1 to rc8. Any distribution that runs these kernel releases with the idpf driver loaded is potentially exposed.

The CVSS score of 5.5 indicates a medium impact. The EPSS score is reported as less than 1%, suggesting a very low chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying that no known publicly available exploits exist. Based on the description, it is inferred that the attack vector is local and requires privileged code execution that can trigger a kernel reset to invoke the leaking path.