The Linux kernel’s MTD virtual concatenation subsystem creates a unique device name when registering a virtual concat. If a destination device with that name already exists, the code mistakenly skips freeing the newly allocated string. This oversight leads to a memory leak that can grow unbounded each time the registration path is exercised. Repeated or sustained registrations therefore drain kernel memory, which can eventually lead to a denial of service by exhausting the system’s memory resources. The flaw does not provide a direct code‑execution path or disclosure of privileged data.

All mainstream Linux kernel builds that include the MTD virtual concat subsystem are vulnerable, regardless of distribution. The advisory lists Linux kernel itself as the affected product, with no explicit version range; the issue exists in any kernel containing the unpatched mtd/virt-concat code until the fix is applied.

The fault does not expose arbitrary code execution or privilege escalation. The risk is limited to potential denial of service. The EPSS score is not available and the vulnerability is not in CISA’s KEV list, indicating a low probability of exploitation. Based on the description, the likely attack vector is a local attacker with the ability to register MTD devices, which typically requires privileged or root access. If an attacker can repeatedly trigger the registration routine, the memory leak may be triggered to drain memory and crash the kernel.