The flaw is a memory leak that occurs in the Linux kernel’s mm/vma subsystem when a process maps "/dev/zero" with MAP_SHARED and a failure path in __mmap_region fails to release a newly allocated shared‑memory file. The unreleased file descriptor remains counted in the kernel’s memory pool, and repeated failures can exhaust kernel memory, impairing system stability and potentially causing a denial of service. This is a classic resource management weakness corresponding to CWE‑401 and CWE‑772.

All Linux kernel releases from 6.19 through 7.0 release candidates (rc1–rc7) are affected unless they contain the patch that adds a missing fput() call in the error handling of __mmap_region. Any distribution running one of these kernel versions without the commit 605f6586ecf7 is vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The issue is local: an attacker would need to execute code that triggers the mmap path or use fault injection to repeatedly invoke the failure path, with no apparent remote or privilege‑escalation vectors. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited evidence of active exploitation. Nevertheless, kernel memory exhaustion can lead to local denial of service, so any use of shared‑memory mappings that could trigger the failure path should be considered a potential risk.