A flaw in the Linux kernel’s mtd_parser_tplink_safeloader_parse() function caused a memory leak when allocating the buffer used to parse a table. If the allocation for a table entry’s name fails, the code jumps to the error handling label without freeing the temporary buffer, leaving the kernel’s memory permanently allocated. Repeated exploitation via the tplink_safeloader parser can cause uncontrolled memory consumption, potentially leading to a kernel panic or degradation of system performance.

The vulnerability applies to the Linux kernel globally; specific vendor and product information is limited to Linux kernel releases that include the tplink_safeloader parser. No affected version range is listed, but the issue was fixed by commits referenced in the provided kernel patch set.

No EPSS score or CVSS rating is provided, and the vulnerability is not listed in the CISA KEV catalog, indicating a low public exploitation probability. Attackers would need the ability to invoke the tplink_safeloader parser repeatedly on the target system, which typically requires local or privileged access. The primary risk is denial of service due to kernel memory exhaustion rather than remote code execution.