A kernel memory leak is caused by the Linux sparx5 network driver when destroying matchall filter entries. The function that removes a matchall entry from the internal list fails to free the allocated structure, leaving the memory resident in the kernel heap. This deficiency is a classic improper release vulnerability classified as CWE-772. The leak gradually consumes kernel memory space as filters are repeatedly added and deleted.

The vulnerability exists in the sparx5 driver component of the Linux kernel, affecting any distribution that includes the unpatched kernel code. Embedded platforms such as the lan969x EV board (EV23X71A) that use the driver for offloaded matchall mirror and goto filters are explicitly impacted, but any system running a kernel version with the missing patch is susceptible.

The ability to add and remove matchall filters requires access to the traffic control subsystem, which typically demands local or elevated privileges; the likely attack vector is therefore local exploitation. No remote exploitation path is disclosed. The EPSS score is < 1% and the CVSS score is 2.3, indicating low severity; the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. An attacker with sufficient privilege who repeatedly executes the add/delete cycle could exhaust kernel memory, leading to instability or a kernel panic. The low severity score but potential for resource exhaustion still warrants prompt remediation.