A missing reference release in the Linux kernel’s device mapper multipath (dm mpath) module caused a resource leak when the kernel failed to retrieve a SCSI device handler (scsi_dh) name with an out‑of‑memory error. The leak occurs because the module does not call dm_put_device() to drop the reference to the path device. Over time, repeated invocations can exhaust kernel memory or lead to system instability, potentially allowing an attacker to force a denial‑of‑service scenario.

The vulnerability applies to Linux systems running a kernel version that lacks commit fd81bc5cca8f. Any distribution shipping an affected kernel is impacted. No specific version range is provided in the CVE record, but any kernel missing this commit is susceptible.

The EPSS score is 0.00021, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 5.5 indicates medium severity. Because the flaw requires the kernel to parse a device path and the exploitable condition is triggered by a negative allocation error, the attack vector is likely local with elevated privileges. The risk to confidentiality or integrity is low; the primary risk is availability due to resource exhaustion.