The vulnerability resides in the LoongArch KVM implementation of the Linux kernel. During device creation, the kernel allocates a kvm_device structure but does not release that memory when the device is destroyed, leading to a memory leak. The impact is a gradual accumulation of orphaned memory that can exhaust system resources, potentially resulting in degraded performance or denial of service if the leak persists for enough time.

Affected systems are Linux kernel builds that include the KVM module for the LoongArch architecture. The vulnerability applies specifically to LoongArch-enabled kernels; vendor and version information is not enumerated in the CNA data, so any kernel with the KVM module that has not yet incorporated the upstream fix is susceptible.

The CVSS score is not provided, but the EPSS score is below 1 %, indicating a very low probability of exploitation under normal conditions. The vulnerability is not listed in CISA’s KEV catalog, underscoring that it has not been linked to known exploit activity. The likely attack path requires an attacker to create and delete a KVM device on a LoongArch system, which is an operation typically performed by privileged users or within the context of VM management. Because no remote trigger is described, exploitation would be limited to environments where the attacker can control the creation of virtual devices or repeatedly alter the resource usage of a target system to provoke a memory exhaustion scenario.