The flaw resides in the Linux kernel’s iomap subsystem. When an atomic dio operation creates a short bio, the REQ_ATOMIC size check rejects the before it is submitted. The legacy error handling path drops only the bio reference, leaving the pages attached to the bio unreleased. Consequently, kernel pages accumulate, potentially exhausting memory and allowing the system to become unstable or unavailable. This issue represents a classic kernel memory leak, which when exploited repeatedly can lead to a denial of service.

Any installation running a Linux kernel that has not incorporated the patch referenced by the commits 27ddd3442fc6f698fb8577c7cfb243ddd81ea8c0 and 681e452683b69a8e1a571cba0f238f8ceacf55d2 remains vulnerable. The vendor and product are Linux:Linux, and version information is not specified in the CVE file; therefore all kernels lacking the fix should be considered at risk.

Based on the description, it is inferred that the vulnerability can only be triggered by privileged code capable of performing atomic dio operations, implying that an attacker must have kernel or root access. The CVSS score of 5.5 reflects a moderate impact, while the EPSS score of < 1% indicates a low exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an attacker who can repeatedly provoke the error path could drain kernel memory, leading to a local denial of service. The low EPSS and absent KEV designation do not eliminate the risk, which remains moderate when privileges are obtainable.