An off‑by‑one error in the Linux kernel’s liquidio driver causes the cleanup routine to skip the last allocated network device when failure occurs, which results in a memory leak. Over time the unreleased memory accumulates, potentially exhausting system memory and degrading kernel performance. While the advisory does not confirm a direct denial of service, the leakage could impinge on overall system stability if the condition repeats.

The flaw exists in the pool‑fabric (PF) support of the liquidio network driver within the Linux kernel. The advisory does not specify which kernel releases are affected; however, any kernel build that did not incorporate the referenced patch commit remains vulnerable. Administrators should review their kernel version against the commit list linked in the references to determine eligibility for the fix.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. Because the bug resides in code executed during device initialization, the attack vector is inferred to be local with privileged kernel access. No public exploit is documented, and the vulnerability is not present in the CISA KEV catalog, which collectively limits immediate threat but still warrants timely mitigation to avoid potential resource exhaustion.