The Linux kernel file system code contains a latent memory leak in the clear_inode() routine. When excess XArray nodes are not freed, the kernel retains references to these structures. Additional invocations of madvise can trigger the leak, gradually exhausting available kernel memory. As kernel memory is a scarce resource, prolonged leakage can cause system instability, hangs, or require a reboot, which translates to a denial of service for all operations running on the host.

Any system running a Linux kernel version that has not incorporated the recent patch that adds xa_destroy() to clear_inode(). All major Linux distributions, regardless of vendor, are affected until they update to the latest kernel release that includes this fix. The change is in the core kernel, not a vendor‑specific patch, so all standard builds are impacted.

The risk may be considered high because memory exhaustion can cripple system functionality, but exploiting the flaw requires a specific sequence of file operations that invoke madvise, making casual exploitation unlikely. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly known exploits. Nonetheless, the lack of an EPSS figure and the kernel's critical role advise treating the issue with caution, especially in environments where file system operations are frequent or uncontrolled.