In Linux kernels the ipv6_flowlabel_get function allocates a new entry for each successful flowlabel GET request. The implementation of the recheck path for an existing flowlabel fails to enforce the maximum lease count per socket, allowing an attacker to repeatedly issue GET requests for a shareable label and grow the socket's lease list without bound. This unchecked growth can exhaust system memory and lead to a denial of service. The weakness corresponds to Resource Exhaustion and improper resource limit enforcement, which are reflected in the associated CWEs.

All deployments of the Linux kernel that include the ipv6 flowlabel subsystem are potentially affected, regardless of distribution. No version range is specified, so any kernel prior to the bug fix should be treated as vulnerable.

The CVSS score is 5.5, indicating a moderate severity vulnerability. The EPSS score of <1% indicates a very low probability of exploitation. Based on the description, the likely attack vector is an attacker issuing repeated flowlabel GET requests, either locally or via the network. An attacker who can issue repeated flowlabel GET requests, either locally or through the network, could cause the socket's lease list to grow without bound, leading to significant memory consumption and potential denial of service. The vulnerability is not listed in the CISA KEV catalog, so no large-scale exploitation has been reported yet, but the possibility of memory exhaustion remains a concern for affected systems.