The EDAC/versalnet driver in the Linux kernel leaks memory because the device name created with kzalloc() in init_one_mc() is not freed on normal removal. The leaked pointer is lost after device_register() resets dev->init_name to NULL, so the allocated memory becomes unreachable and cannot be reclaimed. This uncontrolled retention of memory, classified as a memory‑leak flaw, can lead to gradual exhaustion of kernel memory if the driver is repeatedly loaded and unloaded, potentially causing service interruptions or a local denial‑of‑service. Based on the description, it is inferred that unloading the driver without the patch can repeatedly allocate memory that is never freed, which over time can degrade overall system stability.

The vulnerability is present in the Linux kernel’s EDAC/versalnet driver. It affected all kernel releases that included the vendor’s versalnet driver before the patch was applied. Administrators should consider any kernel version preceding the commit that introduced stack‑based name allocation as potentially vulnerable.

The exploit requires local interaction with the kernel to trigger device creation and removal. Because it does not offer remote code execution or privilege escalation, it is considered a low‑to‑moderate risk. The EPSS score is < 1%, it is not listed in CISA’s KEV catalog, and the CVSS score is 5.5. Based on the description, it is inferred that a memory leak can degrade system stability over time, potentially leading to service interruptions, so remediation through a kernel update is prudent.