The Linux kernel liquidio driver contains an off‑by‑one error in the PF setup_nic_devices() cleanup routine. When a network device fails to initialize, the cleanup loop skips the failing index, leaving a reference to the device unfreed and leaking kernel memory. This bug can accumulate over the life of the system, potentially exhausting memory or degrading performance.

All Linux kernel builds that do not include the patch commit are affected, including release candidates 6.19rc1 through 6.19rc8 and any earlier stable releases lacking the update. Administrators should verify that the kernel image being used incorporates the commit listed in the advisory references and compare against local version strings.

The CVSS score of 5.5 indicates moderate severity and the EPSS score of <1% suggests a low probability of exploitation. The bug is exercised during PF device initialization, so it would require a local user with the ability to load or reconfigure the liquidio driver to trigger the leak. Based on the description, it is inferred that local privileged users who can invoke device allocation are the likely attackers. The vulnerability is not listed in CISA’s KEV catalog, limiting immediate threat, but it still warrants remediation to prevent potential resource exhaustion.