The vulnerability exists in the XFS file system driver of the Linux kernel. When the function that allocates a quota transaction object is called, a failure to insert that object into an rhashtable results in the new object never being freed. The leaked memory accumulates with each failure, eventually exhausting kernel memory and causing system slowdown or crashes. The weakness is a missing release of a resource after allocation and a memory leak, noted as CWE‑772.

All Linux kernel releases that include the XFS file system driver prior to the commit that adds the missing free operation are affected. The CVE references point to kernel commits that introduced the fix, but no specific kernel version list is given. Therefore, any distribution using a kernel version before the applied patch that contains the missing free is potentially vulnerable.

The CVSS score of 5.5 indicates a medium severity vulnerability, while the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local attacker with sufficient privileges who can trigger repeated rhashtable failures to induce the memory leak. Remote exploitation is improbable because the leak requires kernel‑level interactions that are not directly exposed to network traffic.