An improper memory management flaw exists in the Linux kernel’s stream parser. When a stream is aborted—such as after a message assembly timeout—the parser may keep a reference to a partially assembled packet in the skb_head field. That skb is never released, resulting in a cumulative memory leak. Repeated aborts can deplete system memory, leading to a denial of service. The weakness maps to CWE‑772 (Missing Release of Resource).

The flaw resides in the generic net: strparser component of the Linux kernel and therefore affects all builds that include this code. No vendor-specific or version-specific restrictions are listed. Any kernel version that predates the inclusion of the patch commit 19ca9475f18f991735f98a22e735c43e95e6298d is potentially vulnerable.

The CVSS score is 5.5 and no EPSS data are available, indicating that the likelihood of exploitation is not quantified by public sources. The vulnerability is not listed in the CISA KEV catalog, so no widespread, known exploitation cases exist. The attack vector would be remote network traffic that triggers stream parsing aborts—an attacker could send malformed packets or craft streams that time out, repeatedly exercising the leak path. In environments where services expose the stream parser to untrusted traffic and lack strict rate limiting, the risk could be moderate to high, especially if the system has limited memory resources.