The Linux kernel idpf module contains a flaw where the flow steering list is not cleared when the module is removed while entries remain. The list holds pointers to memory that must be freed, and their omission causes a persistent memory leak that can grow over time. The cumulative leak can exhaust kernel address space, potentially leading to system instability or a denial‑of‑service condition. The weakness is improper deallocation of dynamically allocated memory (CWE-401).

This issue affects the Linux kernel, specifically versions 6.17 and 6.19 from release candidate 1 up through release candidate 8. All distributions using these kernel releases are impacted, as the vulnerability is present in the core kernel source regardless of vendor customizations.

With a CVSS score of 5.5 the vulnerability is considered medium severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local access to unload the idpf module while flow steering entries are still active; no remote attack vector is identified. The practical impact is a gradual deterioration of kernel memory availability that could terminate processes or lead to kernel panics if left unchecked.