The Linux kernel includes an attribute for the FOU (Free‑Out‑of‑Band) protocol, FOU_ATTR_IPPROTO, which must not be set to value zero. When zero, the packet receiver fails to free the associated socket buffer and it is not re‑delivered. This oversight causes a kernel‑level memory leak that can accumulate until system memory is exhausted, ultimately destabilizing the kernel or halting further packet processing. The vulnerability is a classic case of resource mismanagement leading to denial of service. Based on the description, no direct exploitation code is provided, but an actor capable of injecting packets that set FOU_ATTR_IPPROTO to zero could trigger the leak.

Affected systems are Linux kernel builds from 6.19 RC1 through RC6, as indicated by the CPE list, and any kernel that contains the vulnerable fou_udp_recv implementation. The flaw is present in every Linux kernel that ships the fou module without the applied patch. If a system is running 6.19 or later but has not yet incorporated the fix, it remains affected.

The CVSS score of 7.8 classifies the issue as high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack likely requires the attacker to be able to craft or influence FOU packets, which could be possible from external network traffic or local privileged contexts. Because the flaw leads to kernel memory exhaustion, the impact is severe, but the likelihood of an attacker successfully triggering it remains low without further conditions.