This vulnerability exists in the Linux kernel’s rxrpc_recvmsg function, where a reference to an already released call object is incorrectly retained when the MSG_PEEK flag is used. The erroneous reference counting results in a deterministic memory leak within the kernel, potentially exhausting available memory over time and causing system instability. The flaw does not provide code execution or privilege escalation; it purely degrades resource availability.

All Linux kernel builds containing the unpatched rxrpc_recvmsg implementation are vulnerable. No specific kernel version identifiers are provided, so any distribution running the default kernel should be considered at risk until the relevant commit is applied.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than 1 % reflects a low likelihood of exploitation observed to date, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to open an rxrpc socket and perform a recvmsg with the MSG_PEEK option, which can be achieved by either a local or remote process. The attack does not grant arbitrary code execution or privilege escalation but can cause a denial of service by exhausting kernel memory through repeated leaks.