The Linux kernel’s MTD virtual concatenation subsystem generates a device name for each virtual concat registration. If a device with that name already exists, the code mistakenly skips freeing the newly allocated string, causing a memory leak that can grow unbounded with repeated registrations. This flaw does not provide direct code execution nor data disclosure, but it can exhaust kernel memory and lead to a denial‑of‑service condition.

All Linux kernel builds that include the MTD virtual concat subsystem are vulnerable; the advisory lists the kernel itself without a specific version range, implying that any kernel containing the unpatched mtd/virt‑concat code is affected until the fix is applied.

The CVSS score of 5.5 classifies the issue as medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a local attacker with the ability to register MTD devices—repeated or sustained registrations would drain kernel memory and potentially crash the system.