The vulnerability causes unreferenced configfs items to persist after a null_blk device is removed, leading kmemleak to report a memory leak. The leak can consume kernel memory over time but does not provide direct code execution or privilege escalation. The weakness follows a classic resource‑leak pattern.

All Linux kernel installations that include the null_blk driver with CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION enabled are affected. The issue is present in kernel releases where the null_blk fault‑injection code was patched to release references upon device removal, as referenced by the linked commit identifiers.

The CVSS score of 5.5 denotes moderate severity, while the EPSS score is less than 1 % indicating a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack would be local and would require root or kernel‑module privileges to activate fault injection and trigger the memory leak. Because the impact is limited to memory consumption and not immediate privilege escalation, overall risk remains moderate.