The mtk-smi driver in the Linux kernel contains a flaw that retains a reference to the SMI device when a probe is deferred or the driver is unbound, causing a memory leak. This leak permits memory consumption to grow without bound, potentially leading to device corruption or a denial‑of‑service if the kernel exhausts available memory. The weakness corresponds to improper release of resources (CWE-911) and improper resource release (CWE-401).

The issue applies to any Linux kernel that includes the unpatched mtk-smi driver. No explicit kernel version numbers are provided, so all kernels lacking the referenced commit remain at risk.

EPSS data indicates a very low likelihood of exploitation (score < 1%). The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. The CVSS score of 5.5 reflects moderate severity. The likely attack vector is inferred to be local, where an attacker can induce a probe deferral or manually unbind the driver, leading to a memory leak that can grow unchecked. Repeated failures could exhaust kernel memory and cause a denial of service.