The Linux kernel smartpqi driver contained a memory leak in the pqi_report_phys_luns() function. Specifically, when the function encounters an unsupported data format or fails to allocate memory for rpl_16byte_wwid_list, it returns early without freeing the rpl_list buffer. This bypass of cleanup logic causes memory leaks. The fix involved adding a unified error handling label and using goto statements to guarantee that rpl_list is freed on all failure paths. The vulnerability is classified under CWE-401 (Improper Release of Memory).

The vulnerability results in a memory leak within the kernel driver, which can degrade system stability or availability over time due to resource exhaustion. There is no impact on confidentiality or integrity. The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, and an impact limited to availability.

A fix is available as the vulnerability has been resolved in the Linux kernel source code by consolidating error handling to ensure proper memory release. Users should update to the fixed kernel version once released. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact patched versions and apply updates accordingly.