The Linux kernel contains a flaw in the function codetag_load_module() that may fail without propagating its error code. When this occurs, load_module() incorrectly returns 0, implying the module was loaded successfully even after being torn down. Additionally, when a livepatch module is being loaded, the structure allocated by copy_module_elf() leaks because the error path does not perform the intended cleanup. This is a CWE‑393 improper error handling flaw that can mislead administrators and waste memory over time.

All Linux kernel builds that include the codetag_load_module() function are affected. This includes kernel releases prior to the commit that introduced the error‑handling fix and the livepatch cleanup label. Based on the vendor list, it can be inferred that any Linux distribution packaging such a kernel may be impacted, but the CVE data does not enumerate specific distributions.

The CVSS score is 4.4 and the EPSS score is less than 1 %. It is inferred that a local user with the ability to load kernel modules via insmod or modprobe could trigger the fault, as the error path is executed during module loading. The lack of public exploitation evidence and the low EPSS score suggest that this vulnerability is not a high‑risk target for remote attackers, although the silent failure and memory leak present operational concerns for administrators.