The EDAC/versalnet driver in the Linux kernel leaks memory because the device name created with kzalloc() in init_one_mc() is not freed on normal removal. The leaked pointer is lost after device_register() resets dev->init_name to NULL, so the allocated memory becomes unreachable and cannot be reclaimed. This uncontrolled retention of memory, classified as a memory‑leak flaw, can lead to gradual exhaustion of kernel memory if the driver is repeatedly loaded and unloaded, potentially causing service interruptions or a local denial‑of‑service.

The vulnerability is present in the Linux kernel’s EDAC/versalnet driver. It affected all kernel releases that included the vendor’s versalnet driver before the patch was applied. The specific affected Linux kernel version ranges are not listed in the advisory; administrators should consider any kernel version preceding the commit that introduced stack‑based name allocation.

The exploit requires local interaction with the kernel to trigger device creation and removal. Because it does not offer remote code execution or privilege escalation, it is considered a low‑to‑moderate risk. The CVSS score is not published and the EPSS score is unavailable, but the issue is not listed in CISA’s KEV catalog, suggesting limited current exploitation. Nonetheless, a memory leak can degrade system stability over time, so remediation through a kernel update is prudent.