In the Linux kernel, the lack of bounds checking allowed an attacker to send an arbitrary number of NEW_SERVER messages, leading to unbounded memory allocation. This memory exhaustion can cause the system to become unresponsive or crash, representing a denial-of-service risk.

All Linux kernel deployments are affected, regardless of distribution, as the vulnerability resides in the core kernel networking code. The fix limits registrations to 256 servers per node in the qrtr subsystem.

The vulnerability is exploitable by a hostile client that can communicate over the qrtr interface, potentially from the same host or a trusted network segment. The CVSS score of 7.0 indicates a high severity, and the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the lack of bounds checking still exposes the system to a local or network-initiated denial of service via memory exhaustion. The fix was deployed by kernel developers, indicating that a patch is both available and necessary.