A flaw in the Linux kernel’s TLS asynchronous decryption flow left encrypted socket buffers queued in an async_hold list that were never released after decryption completed. This unused memory is leaked into the kernel heap, potentially allowing an attacker or network client to grow large numbers of buffers and exhaust kernel memory, leading to degraded performance or system failure. The weakness is classified as CWE-911: Insufficient Resource Monitoring and Control.

All systems running any Linux kernel that incorporates the affected TLS code paths are vulnerable. The CVE does not provide a specific affected-version range, so all kernel releases before the backported patch implementing the purge of the async_hold queue may be impacted. This includes mainstream distributions that have shipped kernels before the recent security updates.

The CVSS score of 7.0 indicates a moderate-to-high severity, while the EPSS score being less than 1 % suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to generate TLS traffic that triggers a partial decryption failure, causing the async_hold queue to accumulate unreleased socket buffers. Once the heap memory is exhausted, the kernel could reject further allocations or crash, creating a denial‑of‑service condition. The attack vector is likely network‑based, and requires continuous TLS communication to reach the resource exhaustion threshold.