The kernel function rxkad_verify_response() allocates memory for a ticket and a server key but can leak those allocations on certain code paths. Repeated execution of the vulnerable function results in uncontrolled memory growth, which can exhaust kernel memory and destabilize the system or cause it to fail. The flaw does not directly influence confidentiality or integrity, but it undermines availability. This behavior aligns with CWE-772 (Unreleased Resource). Based on the description, it is inferred that an attacker would need a local process with sufficient privileges to repeatedly invoke the function.

All Linux kernel releases that include the rxrpc stack and have not incorporated the patch identified by commits 34f61a0, 852b9d6, 861b9a0, c4b8f32, and c91f33f are affected. Any distribution using the default kernel configuration with rxrpc enabled is subject to the vulnerability.

The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need a local process with sufficient privileges to repeatedly invoke the vulnerable function. The CVSS score of 7.0 reflects a medium severity impact on system availability, but the very low EPSS suggests the practical likelihood of exploitation is low. Without the patch, a well‑resourced local attacker could deplete kernel memory and cause a denial of service. The lack of a public exploit further reduces the immediate threat, though the potential impact on availability warrants mitigation.