Technical impact
In the Linux kernel, the function lineinfo_changed_notify() fails to release allocated resources when encountering errors, leading to memory leaks. This flaw is a classic example of improper memory deallocation (CWE-401) and could cause a gradual exhaustion of kernel memory, resulting in system instability or denial of service. The vulnerability does not grant any privilege escalation or data exposure, but the impact on long-running systems could be significant if the error paths are repeatedly triggered.
Affected Systems
This issue affects the Linux kernel, specifically version 6.18 and the 6.19 release candidates 1 through 6. The vulnerability is present in the core gpio:cdev subsystem. Systems running these kernel releases are vulnerable until the indicated fix is incorporated.
Risk and Exploitability
The CVSS score of 5.5 categorizes the risk as medium, and the EPSS score of less than 1% indicates that exploitation is considered unlikely at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector appears to be local, requiring code execution within the kernel to trigger the error handling path that leaks memory. No publicly available exploit has been documented.
Ubuntu USN