In the Linux kernel devlink subsystem a memory leak occurs when a child devlink is linked to its parent before registration and the probe subsequently fails. Because the parent devlink is never registered, the nested relation is never released during devl_unregister(), and devlink->rel remains allocated until the kernel deallocates the child. The leaked resource is not released by devlink_free() unless the instance was registered, so the leak persists. This flaw does not permit direct code execution but can exhaust kernel heap space if abused repeatedly, leading to degraded performance or denial of service.

The flaw resides in the generic Linux kernel, affecting any distribution that incorporates the unpatched kernel code. The issue was identified in the devlink module, and no specific kernel version range is listed, meaning all kernels prior to the fix are potentially vulnerable. The affected entities are Linux kernel builds for all supported architectures.

No CVSS score is published and EPSS is unavailable, but the vulnerability is not flagged in the CISA KEV catalog. Attacks would require local access or an ability to influence device probe events, so it is a local, low‑to‑medium risk. The risk level is primarily determined by the potential for gradual memory exhaustion. No public exploits are reported, and the fix is available in the kernel code repository.