The vulnerability occurs in the Linux kernel module managing RAID1 arrays. When a read operation that uses the REQ_NOWAIT flag is retried, the function raid1_read_request may be invoked with a pre‑allocated r1_bio structure. If the subsequent call to wait_read_barrier fails, the read operation completes immediately but the pre‑allocated r1_bio is never freed, resulting in a memory leak. Over time, repeated occurrences of this scenario can deplete kernel memory and potentially cause a denial of service. The weakness is a flaw in resource handling and corresponds to CWE‑400 (Uncontrolled Resource Consumption).

Vendors: Linux. Products: Linux kernel. Versions: All kernel releases prior to the patch that fixes the leak in the RAID1 read path. The exact version range is not specified in the CVE data, but any kernel using the unpatched raid1_read_request implementation is affected.

The exploit requires local access to a system running a vulnerable Linux kernel. An attacker would need to trigger read requests with the REQ_NOWAIT flag on a RAID1 device; this could be achieved by interacting with applications that issue non‑blocking reads to RAID1 partitions. Since the vulnerability results in a kernel memory leak, it does not provide immediate code execution or privilege escalation, but it can lead to resource exhaustion and service disruption. The EPSS score of < 1% indicates a very low probability of exploitation, and the CVSS score of 5.5 reflects moderate severity. The lack of a remote code execution vector suggests that the risk is primarily a local denial of service scenario.