The Linux kernel bug in the IPMI over SSIF subsystem causes an orphaned kernel thread to persist after an error occurs between thread creation and interface initialization. The stray thread continues to run, consuming CPU resources and memory until the error condition is fully handled, potentially leading to system slow-down or memory exhaustion. This problem is a resource leak, a CWE-772 weakness, arising from failing to clean up the kernel thread when an error is detected. The primary impact is local resource exhaustion, not remote code execution.

All Linux kernel installations that include the older IPMI SSIF implementation are affected. The affected vendor is GNU/Linux and the product is the Linux kernel. No explicit version numbers are listed in the advisory, but any kernel built from source prior to the merge of the fix is vulnerable.

The vulnerability does not provide a direct remote attack path; instead, it is triggered by an internal kernel error that can arise from interactions with firmware or other drivers. The EPSS score is not available, which indicates a low exploitation probability. The issue is not listed in the CISA KEV catalog. The likely attack vector is a local kernel error caused by malformed firmware or misconfigured drivers that trigger the SSIF thread before cleanup, which would require privileged local access or kernel compromise.