The vulnerability is a memory leak in the smartpqi SCSI driver of the Linux kernel. The function pqi_report_phys_luns() fails to free the rpl_list buffer when it encounters an unsupported data format or encounters an allocation failure for rpl_16byte_wwid_list. The missing cleanup results in unbounded kernel memory consumption. This flaw is an instance of CWE‑401 (Memory Leak) and CWE‑772 (Improper Resource Management). If the leak accumulates over time, it can exhaust available kernel memory, degrade performance, or cause the kernel to become unresponsive.

Linux kernel implementations that contain the smartpqi SCSI driver, namely the upstream Linux kernel used by most mainstream distributions. No specific kernel version range is provided in the CVE data, so all kernels that include the affected code path should be considered potentially vulnerable.

The CVE description does not explicitly state an attack vector. Based on the description, it is inferred that the flaw could be triggered by local operations that exercise the smartpqi driver, such as repeated SCSI commands. The flaw does not provide remote code execution or privilege escalation; it only creates a memory pressure condition. The CVSS score of 5.5 indicates moderate risk to availability. The EPSS score of <1 % suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog.