The vulnerability allows a memory leak in the Linux kernel’s Xen SCSI backend when the scsiback device is removed or fails during probing. Memory allocated for the vscsiblk information structure is not released, which can grow until system memory is exhausted, potentially causing performance degradation or service interruption. The flaw is classified as CWE‑401, indicating a failure to properly free allocated memory.

This issue affects the Linux kernel, specifically versions that include the Xen SCSI backend. Known affected kernel releases include 6.19 releases and their release candidates (rc1 through rc6). The kernel source files and commits referenced in the advisory show the problem across those early 6.19 development stages.

The CVSS score of 5.5 places the vulnerability in the medium severity range. The EPSS score is less than 1%, implying a very low probability of exploitation observed in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation would require a local privileged user with the ability to trigger a scsiback_remove operation, such as by removing a Xen SCSI device or manipulating the device’s lifecycle, indicating that an attacker would need local access and kernel privileges. The impact is limited to resource exhaustion rather than direct confidentiality or integrity compromise.