In the Linux kernel, the memory block accounting functions memblk_nr_poison_inc() and memblk_nr_poison_sub() call find_memory_block_by_id(), which acquires a reference to a memory block device. The functions never drop that reference after updating the poison count, leaking one device reference each time a lookup succeeds. Over time, the leaking references can accumulate, exhausting kernel memory or stressing kernel resources, which may degrade performance or cause instability. The flaw is a classic memory‑leak vulnerability (CWE‑772).

Affected systems are Linux kernel releases 7.1 release candidates 1 through 4. Any distribution that includes an unpatched kernel from this series is vulnerable. Kernel versions matching the generic CPE pattern for Linux also fall under this risk if they contain the unpatched functions.

The CVSS base score of 5.5 indicates moderate severity. An EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, further implying limited real‑world attacks. Exploitation likely requires local code execution with kernel privileges, such as a malicious kernel module or privileged process repeatedly invoking the memory‑block API to drain references over time.