A missing reference release in the Linux kernel’s device mapper multipath (dm mpath) module caused a resource leak when the kernel failed to retrieve a SCSI device handler (scsi_dh) name with an out‑of‑memory error. The leak occurs because the module does not call dm_put_device() to drop the reference to the path device. Over time, repeated invocations can exhaust kernel memory or lead to system instability, potentially allowing an attacker to force a denial‑of‑service scenario.

The vulnerability applies to Linux systems running the Linux kernel before the inclusion of commit fd81bc5cca8f. All distributions that ship the affected kernel version are impacted. No specific version range is provided in the CVE record, but any kernel lacking this commit is susceptible.

The EPSS score is not available and the vulnerability is not listed in CISA KEV. The CVSS score is not published in this data set, so the exact severity is unknown. Because the flaw requires the kernel to parse a device path and the exploitable condition is triggered by a negative allocation error, the attack vector is likely local with elevated privileges. The risk to confidentiality or integrity is low; the primary risk is availability due to resource exhaustion.