The vulnerability occurs when a Small Form‑factor Pluggable (SFP) module removes its MDIO bus without freeing the allocated struct mii_bus. Because the bus is created with a plain allocation and the destroy function only unregisters it, the memory is leaked each time a copper or RollBall SFP module is hot‑removed. This memory‑management weakness is an instance of CWE‑772: missing release of memory after allocation. Repeated leaks can consume kernel memory, potentially destabilizing the host system and leading to a denial‑of‑service state. There is no known remote exploitation vector; the impact arises only from the physical removal of an SFP device that the driver manages.

This flaw affects Linux kernel systems that load the net phy sfp driver, specifically the MDIO bus creation path used for copper/RollBall SFP modules. The fault is present in kernel versions before the fix, which introduced a free call in the driver’s destroy routine. No specific version numbers are listed in the advisory, so any kernel that implements the legacy sfp_i2c_mdiobus_create/destroy pair is potentially affected.

The CVSS score is 5.5, and the EPSS score is < 1%, indicating a moderate to low exploitation probability. The flaw is not catalogued by CISA KEV, further suggesting it has not been widely exploited. Since the vulnerability requires a SFP module to be physically hot‑removed, the attack surface is restricted to environments where such modules are used and removed manually or via automation. The risk is moderate: while it does not allow code execution, repeated memory leaks can degrade system performance or trigger a reboot, representing a low‑to‑medium impact on availability in vulnerable deployments.