In the Linux kernel’s lpfc SCSI driver, memory allocated for the mailbox queue (mboxq) via mempool_alloc() is not freed during some early exit error paths in the driver_resource_setup() routine. The unchecked allocation leads to a memory leak that can gradually consume kernel memory. While the flaw does not allow direct code execution or privilege escalation, the accumulated loss of memory can degrade performance and, over time, trigger a kernel out‑of‑memory condition or a denial‑of‑service of the system.

Any Linux kernel that includes the lpfc driver and has not yet incorporated the Git commit adding the missing mempool_free() call is vulnerable. This includes all shipping kernel versions containing that driver until the update is applied. The advisory does not list a specific suite of releases, so all unpatched lpfc implementations are at risk.

The CVSS score is 5.5 and the EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV. The lack of known public exploits suggests a low immediate threat, but the behaviour can be triggered repeatedly by error paths in resource setup. Based on the description, it is inferred that an attacker with the ability to send SCSI commands or otherwise provoke an error in the lpfc initiator could provoke the memory leak. Over time, an attacker could exhaust kernel memory, leading to a kernel panic or forced reboot, effectively causing a denial‑of‑service. The moderate severity and low probability of exploitation result in a moderate risk that escalates with persistent use.