The vulnerability originates from the TPM 2.0 session code in the Linux kernel, where the function that reads a TPM object’s public area fails to free a buffer allocated on the page stack in two code paths. This omission can cause a kernel memory leak, gradually exhausting available memory and potentially leading to a denial‑of‑service condition when the system runs out of pages. The leak is purely a resource depletion issue with no direct integrity or confidentiality impact, but it can degrade system performance and stability.

All Linux distributions that bundle the affected Linux kernel versions are susceptible, as the CPE entry "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*" indicates a universal kernel target. The specific vendor names are not provided beyond "Linux:Linux"; however, any system running the affected kernel revision should be considered at risk until the patch is applied.

The problem is a missing cleanup routine rather than an input validation flaw, so exploitation requires the ability to trigger the tpm2_read_public() function repeatedly. The likely vector is local extraction of TPM resources, meaning that a user with at least local access to the kernel’s TPM subsystem could initiate the leak. No known public exploits exist, and the CVE does not appear in CISA’s KEV catalog. The EPSS score is not available, implying no recent quantitative assessment of exploitation probability. Nevertheless, the high severity of a memory‑leak exploit that can cause the kernel to run out of pages warrants a defensive posture.