The flaw is a reference‑counting error in the Linux kernel’s devlink subsystem. When a notify work routine is already pending, the code takes an extra reference on a devlink_rel object, then ignores the return value of schedule_delayed_work(). As the work runs only once the extra reference is never released, resulting in a leak of devlink_rel objects and their indices. The kernel’s reference counter never reaches zero for these leaked objects. This defect does not directly provide a code‑execution path; its primary consequence is the accumulation of kernel memory that could potentially be exploited for resource exhaustion if a malicious user can repeatedly trigger the leak. That downstream impact is inferred from the description rather than explicitly stated in the CVE data.

Any Linux kernel build that includes the devlink subsystem prior to the commit series that fixes the reference leak. Versions that have not applied the referenced kernel commits remain vulnerable, especially when frequent registration and unregistration of nested devlink instances occur while the parent devlink lock is held.

The EPSS score is < 1 %, indicating a very low probability that the vulnerability will be actively exploited. The CVSS score of 3.3 categorizes the flaw as low severity and it is not listed in the CISA KEV catalog, so no confirmed exploitation exists. The attack vector is likely local privileged or kernel‑level access, inferred from the need to manipulate devlink objects in kernel space. If an attacker can repeatedly register and unregister nested devlink instances while holding the parent devlink lock, the reference leak would occur. The resulting memory consumption may lead to degraded performance or kernel instability in extreme cases, but the concrete impact of such depletion is inferred rather than directly documented by the CVE description.