In the Linux kernel’s macb network device driver, the routine that creates a phylink instance does not destroy the instance when the probe fails at specific points. This causes the phylink object to be leaked into kernel memory. The leaked instance is never freed, which can reduce available kernel memory and potentially destabilize the system if the leak occurs repeatedly.

All Linux kernel builds that include the macb driver are affected. The issue appears in any distribution that ships an unpatched kernel version containing the macb driver, regardless of minor or patch level, as the driver is part of the mainstream kernel source.

The CVSS score is 5.5, indicating a medium severity. The EPSS score of < 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the ability to trigger the probe sequence of the macb driver, typically by loading the module or causing the kernel to enumerate the device. Without direct module loading privileges or hardware access, the attack surface is limited.