The vulnerability occurs when the Linux kernel attempts to create a histogram variable reference for tracing. If the initialization fails, the allocated field is not freed, leaking memory. Repeated allocations can eventually exhaust kernel memory, leading to system instability or denial of service. The underlying weakness is improper resource management.

Affected systems are Linux kernels running the legacy tracing code that does not include the commit that fixes the problem. Any distribution using a kernel version prior to the integration of commit 656fe2ba85e8 is potentially vulnerable. The CVE does not list explicit affected releases, so systems should verify whether the patch is present or upgrade to a newer kernel.

The CVSS score of 5.5 indicates a medium severity, and the EPSS score is below 1%, reflecting a low probability of exploitation under normal conditions. Attacking this flaw requires inducing a failure in the creation of a tracing var_ref, which is an operation generally restricted to privileged kernel code or to processes that can load or control tracepoints. This suggests a local or privileged attack vector and a low likelihood of widespread exploitation, especially given that the vulnerability is not listed in CISA KEV. Nevertheless, the potential for gradual memory exhaustion makes prompt remediation advisable.