The vulnerability occurs in the Linux kernel when a kvm_device is created via kvm_ioctl_create_device(). The destroy function is expected to free the kvm_device structure, but kvm_ipi_destroy() does not perform the deallocation, creating a memory leak. The affected component is the LoongArch KVM implementation. Attacking this flaw cannot directly compromise confidentiality or integrity, but repeated exploitation could exhaust memory resources, potentially affecting stability and availability.

All installations of the Linux kernel that include the LoongArch KVM subsystem, prior to the patch that corrects kvm_ipi_destroy(). The CNA lists the affected vendor as Linux. No specific kernel versions are enumerated in the advisory; thus any kernel with the uncorrected code may be impacted.

The EPSS score is less than 1 % and the issue is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation in the wild. The flaw does not provide a remote code execution or privilege escalation vector; its exploitation requires repeated interactions with the KVM API, typically from a guest or privileged user. The impact remains limited to resource exhaustion rather than a direct compromise.