The vulnerability pertains to the Linux kernel’s PowerPC XIVE interrupt controller code. During MSI‑X vector allocation for NVMe devices, the kernel incorrectly retrieves chip data from a child domain, causing the allocated xive_irq_data structure to never be freed. This results in an unreferenced memory object that is reported by kmemleak. The retained memory persists until the process finishes, and over time the cumulative leak can deplete physical RAM, potentially leading to system instability or crashes. Based on the description, the leak does not directly grant an attacker new privileges or remote access; it primarily affects resource availability.

Any Linux kernel build that includes the PowerPC XIVE driver and supports MSI‑X allocation for NVMe devices is affected. The issue arises when the kernel is configured for the XIVE interrupt controller. Since the CNA list only provides a generic Linux kernel entry and no specific kernel version ranges are supplied, all PowerPC XIVE‑enabled kernels until the patch is incorporated are at risk. The exact kernel version ranges are not disclosed in the CVE data.

The CVSS score of 5.5 classifies the vulnerability as moderate in severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitability requires local or privileged execution within the kernel, as the memory leak occurs only during the MSI‑X vector allocation path invoked at boot or when an NVMe device is accessed. The likely attack vector is a local driver or malicious NVMe device that forces repeated allocation calls, leading to gradual memory exhaustion over time. No remote exploitation is possible according to the provided data.