The flaw occurs in the RISC‑V KVM implementation within the Linux kernel. When the second memory allocation fails during VCPU vector context creation, a previously allocated memory block is not freed. This residual allocation grows over time and can consume kernel memory, potentially leading to resource exhaustion or a denial‑of‑service condition for privileged users. The weakness is a memory leak and an unreleased resource, classified under CWE‑401 and CWE‑772.

The vulnerability affects the Linux kernel on RISC‑V based systems that use KVM. No specific version range is given, but any kernel build containing the unpatched vector context allocation code is susceptible. The CPE string references generic linux_kernel, indicating that all variants running on RISC‑V with KVM are at risk until the fix is applied.

Exploitation requires privileged access to the kernel, as the trigger occurs during VCPU allocation. The EPSS score of < 1% indicates a very low probability of exploitation, but the vulnerability is still exploitable under the right circumstances. The CVSS score of 5.5 indicates a moderate severity rating. The vulnerability is not catalogued in CISA KEV. Given the potential for gradual memory growth, an attacker could repeatedly trigger allocation failures to deplete kernel memory, possibly causing system instability or a crash. Without a public exploit, the risk is moderate to high, depending on the frequency of allocation failures and the overall memory pressure of the host.