In the Linux kernel block subsystem the routine blk_revalidate_disk_zones fails to free a dynamically allocated structure on error paths after disk_revalidate_zone_resources has allocated args.zones_cond. This results in a memory leak that grows each time the routine is invoked unsuccessfully. The leak does not expose data or allow code execution but, over time, can consume substantial RAM, potentially leading to resource exhaustion and system instability. The weakness is identified as CWE‑401 (Memory Leak) and CWE‑772 (Improper Resource Shutdown or Release).

The vulnerability applies to the Linux kernel block module across all distributions that ship the unpatched code. The CVE data does not specify a precise kernel release range, so any kernel containing the affected callback before the applied fix (commit 29153d128384fa7c48a8ca8d34094b1cbe2d5bdc) may be impacted.

The CVSS score of 5.5 denotes a medium severity vulnerability. EPSS is reported as < 1 %, indicating a very low probability of exploitation. The issue is not listed in CISA KEV. Based on the description, a local attacker who can induce disk zone revalidation failures—e.g., by manipulating disk configuration or performing disk operations that trigger the failing path—could repeatedly drain memory, potentially leading to a denial‑of‑service condition. No remote or privilege‑escalation vector is documented.