The vulnerability in the Linux kernel’s vdpa driver caused an unsupported feature configuration during vdpa_alloc_device() to bypass proper resource cleanup, leaving allocated devices and adapter pointers unreleased. The patch ensures consistent release of these resources in the error path. While the CVE description does not explicitly state a denial of service, the flaw’s nature of uncontrolled memory or resource retention implies that repeated exploitation could lead to resource exhaustion, affecting system stability.

The issue targets the Linux kernel for the Linux vendor. All kernel releases before the patch that include the vdpa driver are potentially affected, regardless of the specific revision number.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% reflects a very low but nonzero chance of active exploitation. The vulnerability is not listed in the CISA KEV catalog. The flaw likely requires local or privileged access to configure vdpa features; without such access the impact is limited. The potential for resource exhaustion is inferred based on the identified uncontrolled resource leakage rather than explicitly stated.