A memory leak exists in the Linux kernel’s SUNRPC implementation. The leak is caused when the gss_alloc_msg function fails to call kref_put() on the gss_auth reference during an error path where kstrdup_const() fails. The missing reference release keeps the gss_auth structure allocated indefinitely, leading to uncontrolled memory consumption. This is a classic memory leak, and the error path also matches CWE-911.

All Linux kernel releases that contain the SUNRPC code before the inclusion of commit 5940d1cf9f42 are potentially affected. The vulnerability applies to any distribution that has not yet applied that commit, regardless of distribution name or kernel version, because the patch is a kernel‑level change.

The CVSS score is 5.5 and the EPSS data is unavailable, so the precise likelihood of exploitation is unclear. The flaw requires a failure of kstrdup_const() during SUNRPC authentication, a path that is triggered by RPC traffic. Based on the description, it is inferred that the attack vector is local to the host or relies on a malicious RPC client that can induce the error path. The vulnerability is not listed in the CISA KEV catalog, indicating that no active exploitation has been documented.