This vulnerability is in the Stratix10 SVC firmware driver of the Linux kernel. It involves a memory leak when gen_pool_alloc fails because allocated persistent memory is never freed, and an erroneous list_del call corrupts the list head during a failed lookup. The secondary issue can lead to kernel memory corruption, which may destabilize the system. The description indicates the bug was fixed by adjusting allocation and freeing mechanisms and removing the erroneous list operation. Based on the nature of the corruption, it is inferred that a local attacker could potentially exploit the bug for privilege escalation, though this inference is not explicitly stated in the advisory.

The flaw exists in the Linux kernel firmware driver named stratix10-svc. All Linux kernels that ship the unpatched driver are considered vulnerable. The specific kernel versions affected are not enumerated in the public data; therefore, any deployment of the kernel that includes the unpatched version of the driver should be considered at risk until the patch is applied.

The CVSS score is 5.5 and the EPSS score is <1%, indicating a low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploit at the time of this advisory. The memory corruption indicates a local kernel‑level vulnerability that would likely require the attacker to have root or the ability to trigger the erroneous code path. Consequently, the risk can be categorized as moderate for systems that run the affected driver. Mitigation is most effective when the kernel is updated to include the commit that fixes the bug.