The vulnerability originates from the TPM 2.0 session code in the Linux kernel, where the function that reads a TPM object’s public area fails to free a buffer allocated on the page stack in two code paths. This omission can cause a kernel memory leak, gradually exhausting available memory and potentially leading to a denial‑of‑service condition when the system runs out of pages. The leak is purely a resource depletion issue with no direct integrity or confidentiality impact, but it can degrade system performance and stability.

All Linux distributions that incorporate the affected Linux kernel versions are susceptible. The CPE entry indicates a universal kernel target, so any system running a vulnerable kernel revision should be considered at risk until the patch is applied.

The vulnerability is a missing cleanup routine, so exploiting it requires repeatedly invoking tpm2_read_public(). The likely attack vector is local TPM access, allowing an attacker with sufficient privileges to trigger the leak. The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploits have been reported. Because the flaw can lead to kernel memory exhaustion and a potential denial‑of‑service, a defensive posture remains advised.