In the Linux kernel's QRTR module, the qrtr_tx_flow subsystem originally used a radix_tree data structure to track flow control. When node allocation occurs, the creation routine links intermediate nodes into the tree one after another. If a subsequent allocation fails, the already linked intermediate nodes are left orphaned, with no associated leaf entry. Because the radix_tree traversal routine visits only slots containing leaf values, these orphan nodes are never reclaimed, causing a kernel memory leak. Persistent allocation failures can gradually consume kernel memory, potentially degrading performance or leading to a crash. The issue is remedied by replacing the radix_tree with an xarray, which properly frees internal nodes when the root structure is destroyed. The flaw is classified as CWE-772 and CWE-401.

Any Linux kernel build that includes the QRTR module and has not applied the recent patch is affected. The vulnerability exists in kernels that still employ the legacy radix_tree implementation for qrtr_tx_flow, so it can be present across a wide range of distributions and kernel releases until the module is migrated to xarray. Systems that rely on QRTR for interprocess or Bluetooth communications are especially relevant.

The memory leak can only be triggered when the kernel allocates QRTR flow entries, requiring kernel or privileged context. No remote exploitation vector is described, and the EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The CVSS score is 5.5, indicating moderate severity, and the flaw is classified as CWE-772 and CWE-401. Nonetheless, a malicious user with sufficient privileges could force repeated allocation failures to exhaust kernel memory, leading to local denial of service or system instability.