A function in the Linux kernel driver for octeon_ep leaks memory when initialization of the control network fails. The code returns early without unmapping mapped resources and freeing allocated configuration memory, creating a kernel‑level memory leak. The overall impact is the gradual exhaustion of kernel memory that could eventually cause system instability or denial of service. The weakness is documented as CWE-401, "Improper Release of Memory or Other Resource During a Failure Condition."

The vulnerability is present in the octeon_ep driver within the Linux 6.19 release candidate kernels (rc1 through rc7). Users running any 6.19rcx kernel are affected unless the patch that corrects the early return has been applied. No other kernel versions are listed as affected.

The CVSS score of 5.5 places the issue in the moderate severity range. The EPSS score of less than 1 % indicates that current exploitation probability is very low, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local privileged or root access in order to trigger failures in octep_device_setup(), as the vulnerable code executes during device initialization. The risk is therefore primarily local and could lead to memory exhaustion through repeated failures, but it is unlikely to be abused via a public remote attack vector.