The Linux kernel’s SMC LLC event handler incorrectly assigns an incoming queue entry to a flow without first checking if a previous entry is still pending. A malicious or buggy peer can send a second CONFIRM_LINK or ADD_LINK_CONT message while the flow’s queue entry is already allocated, causing the kernel to overwrite the pointer and lose the reference to the original allocation. This results in a kmalloc‑96 object leak per spurious message and can accumulate until kernel memory exhaustion occurs, potentially leading to a system crash or slowdown. This flaw is a CWE‑772: Resource Leak.

All releases of the Linux kernel that include the SMC LLC subsystem are affected, with the vulnerability present in every version that predates the published commit that added the missing guard. The fix applies to every kernel that implements the smc_llc_event_handler() function, which is part of the standard kernel tree for both the repository and its downstream distributions.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating that it has not yet been seen in the wild. The CVSS score of 5.5 indicates a moderate severity. Based on the description, it is inferred that the attack vector is remotely reachable via the network stack that transports SMC LLC traffic, given that the offending messages are received over the network. The impact is primarily a resource exhaustion that can degrade system availability if an attacker repeatedly exploits the kernel to leak memory. The lack of a proper guard makes the flaw exploitable from an external peer, but the required traffic patterns are not documented, so the exact effort to trigger the leak is unknown.