In the Linux kernel, the octeontx2-af driver allocates a BPID bitmap during setup. If the driver encounters allocation failures when creating BPID mapping arrays, the allocated bitmap is not released, resulting in a memory leak. Over repeated failures this can exhaust kernel memory and destabilize the system. The weakness aligns with CWE-772 for missing deallocation of a memory manager.

The vulnerability affects any system running a Linux kernel that contains the octeontx2-af driver code. Without specific version information, all kernel releases that compile this driver are potentially impacted.

The EPSS score is <1%, indicating a very low likelihood of exploitation. The CVSS score of 5.5 reflects a medium severity risk. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local or privileged user able to load or restart the octeontx2-af driver, which could trigger the allocation failure path. Because the flaw results only in a memory leak rather than immediate code execution, an attacker would need repeated failures to accumulate memory pressure, making the vulnerability potentially mitigated by resource limits or patching.