The vulnerability arises when the Linux kernel’s traffic‑control (net/sched) subsystem fails to fully release references during a batched RTM_NEWACTION request. When an initialization fails, the cleanup routine stops releasing subsequent entries, leaving remaining actions and their IDR slots allocated. Repeated occurrences can exhaust kernel memory and deplete reusable IDR indices, potentially causing a denial‑of‑service that affects network processing or system stability. The weakness is a reference‑counting flaw identified as CWE-772.

All versions of the Linux kernel are impacted, since the CNA product list is "Linux" and no specific version numbers are provided. The issue exists in any kernel release prior to the application of the patch commits referenced in the advisory.

With a CVSS score of 5.5, the severity is moderate. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the ability to send crafted traffic that triggers the batched RTM_NEWACTION mechanism, enabling an attacker to repeatedly cause the bug and eventually exhaust resources. No evidence of active exploitation is available, so the risk is primarily tied to resource exhaustion rather than immediate remote code execution.