The Linux kernel idpf driver contains a defect where the function idpf_vport_rel fails to free the rx_ptype_lkup data structure, causing a memory leak that is triggered during a reset. The leak accumulates a 4 KiB object for every vport removed, potentially exhausting system memory over time. The vulnerability is catalogued as CWE‑401 and is not known to allow code execution or privilege escalation.

The flaw is present in the idpf driver code path that is compiled for the Linux kernel. It affects the kernel builds listed in the CPEs, notably 6.7 and all 6.19 release candidates up to rc8. Systems running any of these kernel versions that use the idpf driver are at risk; the issue does not affect other drivers or kernel components.

The CVSS base score is 5.5, indicating potential for moderate impact if memory exhaustion leads to degraded performance or a kernel panic. The EPSS score of less than 1% suggests that exploitation is unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need privileged kernel execution and an environment where the idpf driver is reset frequently to trigger the leak. Given the low exploit probability, patching remains the recommended approach.