The vulnerability is located in the sunrpc cache handling of the Linux kernel. The cache_release routine does not free a cache_request when its last reader file descriptor is closed while the request is still active. This omission causes the request and its associated buffer and references to remain allocated. If repeated, the leak can grow kernel memory usage, potentially leading to exhaustion and kernel instability.

All Linux kernel builds that have not applied the sunrpc cache_request leak fix are affected. The advisory lists the package broadly as Linux:Linux with no specific version range, so any unpatched kernel should be considered vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The advisory does not provide a concrete attack vector, but it can be inferred that an attacker would need to invoke a sunrpc cache_read operation and close its file descriptor to trigger the leak. This could occur through local or remote interaction with exposed RPC services, although the exact vector remains unspecified.