In the Linux kernel, a flaw in the blk‑cgroup subsystem causes memory leaks and incorrect flag state when radix_tree_insert fails during block cgroup creation. The error path mistakenly sets the block group as online and calls blkg_put without killing the per‑cpu reference, preventing blkg_release from freeing allocated memory, its iostat, policy data, parent reference, and cgroup CSS reference. This leak can accumulate over time and block cgroups may never be destroyed, leading to resource exhaustion and potential denial of service. This vulnerability aligns with CWE-772 (Resource Leak).

All Linux kernel implementations that include the blk‑cgroup module prior to the application of the commit series referenced by the advisory are affected. The issue applies to any distribution or vendor that ships an unpatched kernel version containing this code path.

The vulnerability is not listed in CISA’s KEV catalog and the EPSS score is < 1%, indicating a very low exploitation probability. The CVSS score of 5.5 reflects moderate impact due to a kernel memory leak that can grow over time. Based on the description, it is inferred that an attacker would need the ability to trigger block cgroup creation failure, which typically requires local kernel execution or elevated privileges and is thus not easily exploitable from a remote network context. The lack of a publicly known exploit and the need for kernel‑level access makes the risk lower than an actively exploited RCE, yet systems must be patched promptly to avoid potential resource exhaustion.