The kernel’s QRTR nameserver does not free the node data structure after a BYE packet is processed, causing a memory leak in kernel space. This defect allows an attacker to exhaust kernel memory by repeatedly sending BYE packets, potentially leading to degraded system performance or service denial, as the leaked memory accumulates over time.

The vulnerability exists in the Linux kernel across all versions that contain the QRTR subsystem, with no specific version exclusions noted.

The bug is a pure memory leak; it does not lead to a crash or arbitrary code execution in the kernel. The CVSS score of 5.5 indicates a medium severity level for this flaw. Based on the description, it is inferred that the exploitation would require a local process capable of sending a BYE packet, which is typically available to privileged users or compromised software. Because the EPSS score is not available and the flaw is not listed in KEV, the immediate threat level is moderate, but the impact on stability can be significant if the leak is repeatedly triggered.