The vulnerability resides in the starfive_aes_aead_do_one_req() function of the Linux kernel’s crypto subsystem. An allocation for rctx->adata is made with kzalloc, but when sg_copy_to_buffer() or starfive_aes_hw_init() fails, the function does not free this memory. Because rctx->adata is always freed later only after a successful write_adata operation, an error path can leave the allocation unfreed, resulting in a memory leak. The weakness can lead to gradual degradation of system memory availability, potentially causing the kernel to experience out‑of‑memory conditions over time. The flaw is a classic resource management defect, identified as CWE‑772 and CWE‑401.

All Linux kernel releases that include the starfive_aes_aead_do_one_req() implementation are affected until a patch that removes the leak is applied. The issue appears in upstream Linux kernel source that contains the starfive driver and affects any configuration that loads the starfive crypto module.

The exploitability of this fault is confined to local privileged processes that can load or manipulate the affected crypto module, as the code operates in kernel context. The likely attack vector is local and requires kernel‑level access. Based on the description, it is inferred that remote exploitation is unlikely. The EPSS score is very low (< 1 %) and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates moderate severity; however, because a memory leak in kernel space can lead to gradual resource exhaustion, the overall risk is significant for systems under high memory pressure.