The vulnerability originates from the Linux kernel’s Industrial I/O (IIO) hw‑consumer buffer implementation, where the scan_mask bitmap is not freed when a buffer is released. This omission causes a cumulative memory leak whenever buffers are created and destroyed. As a result, an attacker could repeatedly trigger buffer allocation and release to exhaust system memory, potentially degrading performance or crashing the host. The weakness represents a resource‑management flaw, classified as CWE‑772.

All Linux kernel releases that incorporate the legacy IIO hw‑consumer buffer logic but lack the commit 9a2e1233d38c, which added the missing free call. The fix was introduced in that commit; therefore, any kernel version built prior to including this change is impacted, regardless of the major release line.

The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an attacker must have the ability to run code in kernel or privileged user mode to create and release IIO buffers. While the impact can lead to a denial of service, it does not provide remote code execution. The uncertainty in the exact CVSS metric suggests treating this as a medium‑to‑high severity issue that warrants prompt remediation.