The Linux kernel’s i_ipmi_request() function contains a reference‑count leak when callers provide a supplied_recv message. The function unnecessarily increments the user’s nr_msgs reference and, on an error, fails to decrement it, resulting in a permanent leak that can consume kernel memory over time. This flaw does not allow immediate remote code execution but can lead to a denial‑of‑service condition if an attacker repeatedly triggers the vulnerable path, exhausting available resources. The weakness is a classic resource‑leak vulnerability, classified under CWE-401.

Linux kernels running before the patch that introduces the explicit decrement in the error cleanup path are affected. All distributions that ship the kernel with i_ipmi_request() in its original form—prior to the commit linked in the advisory—are vulnerable; no version numbers are specified in the advisory, so the issue may exist across all recent kernel releases that have not applied the fix.

The CVSS score of 5.5 and the EPSS score of <1% suggest a moderate severity with low exploitation probability, but the exact exploitation likelihood remains unclear. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be local, requiring an attacker with access to execute IPMI requests that trigger the function. Repeated exploitation could exhaust kernel memory and cause system instability. Because no publicly available exploitation evidence exists, the overall risk cannot be precisely quantified.