The vulnerability exists in the Linux kernel's cgroup blkio memory management, specifically in the blkgs destruction path in block/blk-cgroup.c. When a cgroup is destroyed, the function cgroup_rstat_flush() is only invoked when the blkcg reference count reaches zero via css_release_work_fn(). This circular dependency prevents the blkcg and some blkgs from being freed after being made offline, causing a memory leak. An attacker with local access could exploit this to cause system instability such as out-of-memory errors. Red Hat advisories RHSA-2023:6583 and RHSA-2023:7077 provide kernel updates for Red Hat Enterprise Linux 8 and 9 that address this and other kernel vulnerabilities. The system must be rebooted after applying the updates to activate the fixes.

The vulnerability leads to a memory leak in the Linux kernel's cgroup blkio subsystem, which can cause system instability including out-of-memory conditions. It does not affect confidentiality or integrity but impacts availability. Exploitation requires local access with low privileges. There are no known exploits in the wild at this time.

Official kernel updates are available from Red Hat for Red Hat Enterprise Linux 8 and 9 as detailed in advisories RHSA-2023:6583 and RHSA-2023:7077. Applying these updates and rebooting the system fully mitigates the vulnerability. Users should follow the vendor's instructions for patching and rebooting. Patch status is confirmed by the vendor advisories.