The vulnerability is a memory leak in the Linux kernel’s crypto:caam driver, specifically in the dpaa2_caam_probe routine. When the probe fails because required DPIO devices are not yet ready, the driver allocates net_device structures but does not free them on error paths, leading to leaked allocations. Over time these leaks can accumulate, consuming kernel memory and potentially causing performance degradation or system instability.

All Linux kernel releases that contain the dpaa2 CAAM crypto driver prior to the inclusion of the fix commit are impacted. This includes any distribution that ships an unpatched kernel built with the dpaa2-based crypto acceleration stack, such as generic Linux kernel images used on NXP DPAA2 hardware platforms.

No CVSS score is listed and the EPSS score is unavailable; the vulnerability is not included in CISA’s KEV catalog. The likely attack vector is local or via privileged services that load or reload the kernel module, as the issue occurs during device probing. While exploitation does not provide immediate denial of service, repeated probe failures can gradually increase memory usage, representing a moderate risk to long‑term system stability. It is inferred from the description that the vulnerability requires access to the kernel and the DPAA2 hardware interface.