The vulnerability resides in the Linux kernel's memory policy subsystem, where the function weighted_interleave_auto_store() fails to release allocated memory in two distinct code paths. When a non-empty input is provided, the newly allocated state is discarded without deallocation, creating a leak. Additionally, an empty input bypasses the fetch of the old state, which then remains unreclaimed after an overwrite. A local user can repeatedly trigger this scenario by writing the literal "1" in a loop, causing cumulative memory consumption. The impact is limited to the kernel's memory subsystem, potentially resulting in denial of service if the leak grows unchecked. The weakness is a classic memory allocation bug (CWE‑772).

Both Linux vendor products are affected, as the kernel source is identical across distributions. No specific kernel version range is listed in the advisory, so any kernel containing the stated code path could be vulnerable. Administrators should verify whether their kernel includes the older weighted_interleave_auto_store() implementation that contains the leak.

The CVSS score of 5.5 indicates moderate severity, while no EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The attack vector is local and requires write access to the memory policy interface, which is typically available to privileged users. While the exploit does not grant arbitrary code execution, repeated exploitation can lead to memory pressure and a kernel crash, representing a moderate risk for environments where the interface is exposed. The absence of known public exploits suggests low immediate threat, but the lack of a release note specifying fixation dates warrants timely kernel updates.