The vulnerability arises in the Linux kernel's rxrpc networking subsystem, where the rxgk_verify_response() function fails to free the rxgk context it creates, resulting in a memory leak. This defect leads to unnecessary consumption of kernel memory resources, potentially degrading system performance or causing a denial‑of‑service if the leak accumulates over time. The issue is identified as a memory leak and a resource exhaustion condition, reflecting CWE‑401 and CWE‑772 weaknesses.

The flaw is present in the Linux kernel, specifically in version 6.16 and all 7.0 release‑candidate builds from rc1 through rc7. It affects any distribution or system running these kernel versions that has the rxrpc module enabled, which is common in standard Linux deployments.

The CVSS score of 5.5 indicates a moderate risk, and an EPSS score of less than 1 % suggests that exploitation attempts are unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The main attack vector, while not explicitly defined in the report, is inferred to involve sending crafted or malformed rxrpc responses to a target system, which would trigger the memory‑leak condition. Because the flaw only consumes kernel memory, it does not provide remote code execution or privilege escalation, but repeated exploitation could lead to resource exhaustion or a system crash.