The vulnerability causes a memory leak in the Linux kernel’s Intel RAPL powercap subsystem. When a topology query returns a negative value, the rapl_add_package_cpuslocked() function returns an error pointer but does not free the rapl_package structure it allocated, so memory is leaked on every failed package addition. The likely impact is that repeated failures could drain system memory over time, which may result in a denial of service if the system runs out of usable RAM.

All systems running a Linux kernel that includes the powercap Intel RAPL module before the kernel commit 3e9e9337e03be. Systems that have not applied this commit are vulnerable; users should verify the kernel version supplied by their distribution and install the latest update that includes the patch.

The CVSS score of 5.5 reflects moderate severity, while the EPSS score of < 1% indicates a very low likelihood of exploitation. No public exploits are known, and the vulnerability can likely be triggered only from a local context, as it depends on a negative return from a topology query performed by privileged kernel code. The risk is therefore a moderate local denial‑of‑service scenario that warrants timely patching and monitoring.