The vulnerability is a memory leak in the MediaTek SMI driver for the Linux kernel caused by failing to release references to the SMI device during late probe failures or driver unbind events. The leak can accumulate over time, potentially exhausting available kernel memory, which could lead to system instability, crashes, or a denial of service

The driver is part of the Linux kernel’s MediaTek SMI implementation. All Linux kernel builds that include this driver—primarily distributions for MediaTek SoCs—are affected. The advisory does not specify exact kernel versions; therefore any version before the kernel commit that introduced the fix is vulnerable. Users should verify that their kernel contains the upstream patch

The CVSS score is 5.5, indicating moderate severity, and the EPSS score is < 1%. The vulnerability is not listed in CISA KEV. Because the flaw requires a failure during probe or unbind of the SMI device, exploitation would likely occur only in environments where the driver is loaded often or during boot, making accidental exploitation possible but difficult to trigger covertly. Nonetheless, the potential for memory exhaustion warrants patching as soon as possible