A flaw in the Linux Kernel Connection Manager (KCM) left a zero‑fragment socket buffer chained into the fragment list when a sendmsg operation failed to copy user data. The error path allocates a new skb but does not free it on failure, causing a memory leak, repeated WARN_ON_ONCE messages, and potentially kernel instability. The issue is reflected in CWE‑390. Based on the description, it is inferred that the presence of a zero‑fragment skb in the fragment list can lead to memory consumption growth and kernel instability during repeated failures, ultimately resulting in a denial‑of‑service condition.

Any Linux kernel containing the unpatched KCM implementation is affected. The advisory does not specify particular releases, so all distributions whose kernel code matches the default KCM path before the fix are potentially vulnerable.

The CVSS and EPSS metrics are not provided and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to create a SOCK_SEQPACKET KCM socket and send a malformed message that triggers a copy error; this typically demands local or privileged access. The probability of exploitation in the wild appears low to moderate; successful use would lead to memory consumption growth and a denial‑of‑service condition. The likely attack vector is a local process that can open a KCM socket and invoke sendmsg with data that causes a copy failure. Based on the description, it is inferred that the attacker must trigger the copying error to create the zero‑fragment skb and that the vulnerability is not remotely exploitable without userland access to the KCM interface.