The GenDiskBuilder::build routine in the Linux kernel fails to drop references to a temporary generational disk and its request queue when a partial allocation fails. This oversight allows the leaked structures to persist until a later teardown, thereby consuming kernel resources that should have been reclaimed. The remaining gendisk contains a request queue with blk‑mq state, which can accumulate over time and potentially exhaust kernel memory or block subsystem resources, leading to a denial of service of the block device layer. The weakness is classified as CWE-772 Resource Leak.

All Linux kernel releases older than the commit that introduces the put_disk() cleanup on the error path and the subsequent pairing of GenDisk::build and GenDisk::drop patches with put_disk() after del_gendisk() are affected. The specific version numbers are not listed, so any distribution running a kernel that predates these changes, including mainstream releases that have not yet incorporated the patches, is at risk.

The EPSS score is reported as < 1 %, and the vulnerability is not listed in CISA’s KEV catalog, indicating a very low likelihood of exploitation in the wild. Based on the description, it is inferred that exploitation would require a local context where kernel or driver code triggers a GenDiskBuilder::build failure, such as malformed block driver input or resource exhaustion. The attack surface is therefore limited to systems with untrusted or malfunctioning block drivers and does not enable remote code execution or data disclosure. The potential impact is restricted to resource exhaustion and possible denial of service of the block subsystem.