The vulnerability arises in the smartpqi driver for SCSI devices in the Linux kernel. A failure to release the rpl_list buffer during the pqi_report_phys_luns() routine, when encountering unsupported data formats or when allocation for rpl_16byte_wwid_list fails, leads to a memory leak. The lack of cleanup on early return paths means allocated memory is not reclaimed until deallocation or a system reboot, potentially exhausting kernel memory over time and degrading system stability.

Linux kernel implementations that include the smartpqi SCSI driver, such as the generic Linux distributions using the upstream kernel.

The failure is triggered by SCSI operations that invoke the problematic routine and does not provide remote code execution or privilege escalation. It can only be exploited locally by an attacker with the ability to repeatedly call the routine to accumulate memory pressure, thereby compromising system availability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Given the lack of a CVSS score, the risk is considered moderate for availability in environments with long‑running SCSI workloads.