The Linux kernel bug causes memory that was accounted during mmap_preparation to remain allocated after a failure in call_mmap_prepare, creating a memory leak that can eventually exhaust system memory and result in denial of service. This defect is categorized as CWE‑772, Missing Release of Resource. The issue arises because unmatched accounting is not undone when the preparation step fails, so subsequent abort processing leaves the memory accounted but not freed.

Any installation of the Linux kernel that includes a version built before the commits referenced in the advisory (6cc27d82, 8fdc521d, fb5400bf) is vulnerable. Project vendors are essentially the Linux operating system kernel; no specific distribution is singled out, but any derived kernel before these patches applies. The vulnerability is only present in the kernel code that handles mmap preparation and accounting, and has no effect on user‑space applications directly.

The CVSS score of 5.5 indicates a medium severity. The EPSS score is reported as less than 1 %, implying a low likelihood of public exploitation in the near future. The issue is not listed in the CISA KEV catalog. The flaw is local to the kernel and would typically require a process running in user space that can invoke mmap and cause preparation to fail. Based on the description, it is inferred that an attacker could repeatedly trigger the failure in a controlled environment to drain memory and destabilize the system. No public exploit is currently known.