The kernel function responsible for iterating over memory cgroups mistakenly exits the loop without invoking the required cleanup call, causing the cgroup reference to remain unreleased. The vulnerability description states the leak but does not describe any further observable consequences; it simply notes that the reference remains unreleased.

Linux kernel builds that do not yet include the commit that restores the missing mem_cgroup_iter_break() call are impacted. Any distribution or custom kernel that contains the unpatched iteration logic is vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is below 1 %. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require code execution in the kernel or the ability to trigger the faulty iteration path, which typically necessitates elevated privileges; therefore the attack vector is likely local. No remote attack path is identified in the provided data.