The vulnerability exists in the Linux kernel's smc module where the smc_llc_flow_stop function zeros a flow structure while the flow->qentry pointer still references an allocated object. That pointer is overwritten before any free occurs, causing a single kernel memory object to leak. The defect is a form of improper memory management and can allow an attacker to accumulate leaks over time, potentially exhausting kernel memory and degrading system stability.

Any Linux kernel version that contains the smc subsystem before the applied patch is subject to this flaw. The CNA data does not list specific product versions, but the kernel commit references indicate that the issue was present in all earlier releases. Users running any distribution that has not updated past the commit that introduces smc_llc_flow_qentry_del prior to the memset are affected.

The EPSS score is below 1%, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting a low likelihood of active exploitation. However, the weakness can be triggered by a duplicate CONFIRM_LINK or ADD_LINK_CONT message sent over the network to the smc interface, which would allow a remote adversary to repeatedly cause memory leaks. While the flaw does not grant code execution, repeated exploitation could lead to a denial‑of‑service scenario through kernel memory exhaustion. Monitoring network traffic for anomalous smc packets and applying the patch are the recommended mitigations.