This vulnerability is a memory leak in the Linux kernel's bnx2x network driver. When the allocation of fp[i].tpa_info fails, the error path does not free the previously allocated bnx2x_fastpath structure because it is not linked to the backing pool yet, leading to leaked kernel memory. The leak can accumulate over time, potentially exhausting kernel memory and causing degraded performance or kernel panics. The flaw does not provide malicious code execution or privilege escalation; it is limited to resource exhaustion.

Any system running a Linux kernel that contains the pre‑patch bnx2x driver for network adapters. The vulnerable code resides in the kernel's bnx2x_alloc_mem_bp function, which is part of the built‑in network driver bundle for bnx2x devices.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of public exploitation. With a CVSS score of 5.5, the risk is medium due to potential resource exhaustion. An attacker would need the system to run for a sufficient period while using the bnx2x driver to allow memory to leak. No privileged input or special conditions beyond normal kernel activity are required to trigger the leak.