The Linux kernel for LoongArch contains a flaw in the KVM subsystem where the kvm_eiointc_destroy routine fails to free the allocated kvm_device structure. When a KVM device is created and subsequently destroyed, the unused memory remains allocated, causing a kernel memory leak. This gradual memory consumption can degrade overall system performance and, if left unchecked, may contribute to a denial‑of‑service condition by exhausting available kernel memory.

All Linux kernel builds that support the LoongArch architecture and include the KVM eiointc device code prior to the patch commit 7d8553fc75aefa7ec936af0cf8443ff90b51732e. The affected product is the Linux kernel (LoongArch variant). Any distribution using a kernel version that has not incorporated this fix is at risk.

With an EPSS score of less than 1%, the probability of active exploitation is very low and the flaw is not listed in the CISA KEV catalog, indicating no known exploits. The vulnerability does not provide direct remote code execution; the likely attack vector requires an attacker with the privilege to invoke kvm_ioctl_create_device and trigger repeated device creations and deletions, which would exhaust memory over time. Overall, the risk is low but can lead to resource exhaustion if unmitigated.