The vulnerability arises when a devlink reload operation requests a net namespace different from the current one without triggering a driver reinitialization. devlink_nl_reload_doit() obtains a reference to the target net namespace but fails to release it when the operation returns –EOPNOTSUPP. This resource leak (a CWE‑399 Resource Management – Incomplete Release weakness) can accumulate over time, potentially exhausting kernel resources and destabilizing the system. The impact is local and requires privileged access to issue devlink reload commands.

All Linux kernel builds that include the devlink subsystem are affected, from early stable releases up through the current mainline kernel. No specific sub‑versions are listed, but the issue exists in any kernel that has not yet incorporated the modern fix for this reference leak.

The EPSS score of <1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the bug occurs during an operation that typically requires root or CAP_SYS_MODULE privileges, the attack vector is local with elevated privileges. An attacker with sufficient permissions could repeatedly trigger the problematic code path, incrementally leaking net namespace references and eventually causing kernel instability, crash, or denial of service.