The vulnerability originates from the net/mlx5 driver in the Linux kernel where a bookkeeping structure, mlx5_st_idx_data, is allocated when an RDMA MKey with TPH steering-tag hints is created but never freed when the corresponding ST table entry is finally deallocated. This oversight causes a memory leak that grows with each cycle of allocation and release. The unattended accumulation is flagged by kmemleak as an unreferenced allocation, leading to gradual slab exhaustion. The impact of this leak is a loss of heap resource, potentially resulting in a service outage or kernel panic if the leak continues unchecked. The weakness is akin to an improper resource deallocation flaw.

Linux kernel implementations impacted are all kernels before the fix that introduced freeing of mlx5_st_idx_data in the net/mlx5 driver. No specific vendor version list is provided, so any Linux kernel that has the unpatched net/mlx5 driver is affected.

The exploit is local to processes that can allocate RDMA MRs, such as applications using libibverbs. No remote code execution permissions are required; however, any process with the privilege to request MKeys can trigger the leak. Due to the absence of a CVSS or EPSS score and its non‑listing in CISA KEV, formal risk quantification is unavailable. Nonetheless, repeated churn of MRs can consume kernel memory over time, which is a significant availability risk for systems under heavy RDMA workloads.