The vulnerability resides in the Linux kernel’s rxrpc protocol handler. An error in the key parsing routine can cause memory that was allocated for a token to be left referenced after an error path, resulting in a memory leak. The leaked memory may impact system stability or memory availability. The weakness is a classic memory management issue classified as CWE‑401 and CWE‑772.

The affected code is part of the Linux kernel. Versions 6.16 and all 7.0 release candidates up through 7.0 rc7 are vulnerable.

The CVSS score of 5.5 places the flaw in the moderate range. The EPSS score indicates an exploitation probability of less than 1 %. The vulnerability is not listed in CISA’s KEV catalog. No public exploitation is documented in the CVE record. Based on the description, the likely attack vector would require the attacker to trigger error conditions in the rxrpc protocol, which suggests a local or network‑based vector that can manipulate rxrpc traffic. However, explicit exploitation requirements are not detailed in the available data, so the attack surface is inferred to be limited.