The Linux kernel contains a memory leak in the file system clear_inode() routine: excess XArray nodes are not freed, causing the kernel to hold onto references even after the inode is released. If the leak continues, kernel memory can be exhausted, leading to system instability, hangs or the need for a reboot, effectively delivering a denial of service. The flaw is classified under CWE-772.

Any Linux system whose kernel has not incorporated the fix that inserts an xa_destroy() call in clear_inode(). All mainstream distributions, regardless of vendor, are affected until they upgrade to a kernel release that contains this change. The vulnerability is present in the core kernel code and therefore applies to any compiled kernel in use on standard builds.

The vulnerability has a CVSS score of 3.3 and an EPSS of less than 1%, indicating a moderate severity and a low probability of exploitation. It is not listed in CISA’s KEV catalog. Exploitation requires a specific sequence of file system interactions that trigger madvise, making it hard to trigger in practice. The risk remains for environments that perform frequent or uncontrolled file operations that invoke madvise, as the memory leak can accumulate silently over time.