The vulnerability in the Linux kernel causes a memory leak in the sar_probe() function, where device_mode_info allocated in parse_package() is not freed on certain error paths. The leak does not provide direct code execution or data confidentiality compromise, but can lead to resource exhaustion and degraded system availability if the error scenario is repeatedly triggered.

This issue affects the Linux kernel, with no specific version range identified in the available data. All distributions that ship the affected kernel version are potentially impacted.

The CVSS score is 4.4, and the EPSS score is less than 1%. The vulnerability is not listed in CISA’s KEV catalog. The risk is primarily of availability due to uncontrolled memory consumption. The likely attack vector is through repeated invocation of sar_get_data() or related interfaces that trigger sar_probe(), leading to memory accumulation. Exploitation would require an ability to repeatedly trigger the error paths, which may be feasible for local or privileged users but is not known to allow remote code execution.