The Linux kernel had a vulnerability in the memory hotplug code where the function remove_memory_blocks_and_altmaps() acquired a reference to a memory block device via find_memory_block() but failed to drop this reference during removal. This caused a reference leak of the memory block device, leading to resource exhaustion over time. The patch series "mm: Fix memory block leaks and locking" version 2 addresses this by dropping the reference after retrieving and clearing the altmap before removing the memory block device. This fixes two memory block device reference leaks and a locking issue related to the per-memory_block hwpoison counter.

The vulnerability results in a memory block device reference leak, which can lead to resource exhaustion and potentially cause denial of service (availability impact). There is no impact on confidentiality or integrity. The CVSS score of 5.5 reflects a medium severity with local attack vector, low complexity, low privileges required, no user interaction, and unchanged scope.

A patch has been released as part of the Linux kernel updates addressing this memory block reference leak. Users and administrators should apply the official kernel updates that include the "mm: Fix memory block leaks and locking" patch series to remediate this issue. No additional mitigation steps are indicated.