The vulnerability occurs in the Linux kernel's RDMA mlx4 driver, where mlx4_srq_alloc() did not release its resources when mlx4_ib_create_srq() returned an error. This omission causes kernel memory and objects to remain allocated, leading to a gradual depletion of kernel resources and potential denial of service. The vulnerability is identified as both a Memory Leak (CWE-401) and an Unreleased Resource (CWE-772) issue.

All Linux kernel releases that contained the unpatched mlx4_ib_create_srq() implementation are affected. No specific version numbers are listed, so any kernel version prior to the commit that added mlx4_srq_free() during error handling is considered vulnerable.

The CVSS score of 7.8 signifies high severity, while the EPSS score of less than 1% and the absence from the CISA KEV catalog indicate a low probability of exploitation. Based on the description, it is inferred that an attacker would need to trigger repeated SRQ creation failures via RDMA verbs, which may require the ability to run code that exercises RDMA services. The likely attack vector is through manipulation of RDMA service inputs on the vulnerable host. No documented exploit exists, but continuous leakage could culminate in a resource exhaustion denial of service.