In the Linux kernel’s af_unix module, a failure in the prepare_peercred() function during a Unix domain socket connection leaves the newly created socket structure (newsk) unreleased. The kernel mistakenly skips the call to unix_release_sock(), resulting in a memory leak. The vulnerability falls under improper resource management (CWE-401). Although the leak does not provide direct code execution, repeated triggering of the failure path can gradually exhaust system memory and degrade availability, which explains the moderate‑severity CVSS score of 5.5.

The issue affects any Linux kernel build that predates the commit moving prepare_peercred() before unix_create1(). All distributions running a kernel version without the patch are potentially vulnerable. The fix is merged into the mainline kernel and is present in all releases following the commit, so verifying the running kernel version against this change is required.

The CVSS score of 5.5 shows moderate severity, and the EPSS score of less than 1% indicates the likelihood of exploitation in the wild is low. It is not listed in CISA's KEV catalog. The likely attack vector is inferred: a local attacker who can create or connect to a Unix domain socket could trigger the defective path, and a remote attacker might exploit it if a service exposes Unix sockets externally. Exploitation would require repeated failures in prepare_peercred() to accumulate leaked memory, leading to a denial‑of‑service. No public exploitation has been reported; the risk is largely dependent on how often the vulnerable condition can be exercised.