The kernel function rxkad_verify_response() allocates memory for a ticket and a server key but can leak those allocations on certain code paths. Repeated execution of the vulnerable function results in uncontrolled memory growth, which can exhaust kernel memory and destabilize the system or cause it to fail. The flaw does not directly influence confidentiality or integrity, but it undermines availability. Based on the description, it is inferred that an attacker would need a local process with sufficient privileges to repeatedly invoke the function.

All Linux kernel releases that include the rxrpc stack and have not incorporated the patch identified by commits 34f61a0, 852b9d6, 861b9a0, c4b8f32, and c91f33f are affected. Any distribution using the default kernel configuration with rxrpc enabled is subject to the vulnerability.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need a local process with sufficient privileges to repeatedly invoke the function. The likelihood of exploitation is moderate. Without the patch, a well‑resourced local attacker could bring the system to a state of resource exhaustion, resulting in a denial of service. The absence of a public exploit reduces the immediate threat, but the potential impact on availability warrants prompt mitigation.