The octeontx2-af CGX driver allocates RX/TX flow‑control bitmaps during initialization but fails to free them during exit, causing a persistent memory leak that is reported by the kernel’s kmemleak detector. This defect is a CWE‑401 (Unreleased Memory) and a CWE‑772 (Unreleased Resource) flaw, indicating that resources are not properly released. The leak means that each time the driver is unbound and rebound, small 16‑byte objects remain resident in memory, which over time can exhaust available kernel memory and result in degraded performance or system instability.

The vulnerability affects the octeontx2-af CGX driver component within the Linux kernel. No specific kernel release or version information is provided, so any Linux installation that includes this driver and experiences repeated driver unbind/bind operations may be impacted.

The defect is triggered only when the driver is unbound and rebound, so the attack vector is local and requires the ability to load or unload the driver. The CVSS score of 5.5 indicates medium severity. The EPSS score is < 1%, indicating an extremely low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting no currently known public exploits. Based on the description, it is inferred that the accumulation of unreleased memory objects may lead to increased kernel memory usage over repeated driver unbind/bind cycles, which could eventually affect system performance.