The flaw exists in the SPI driver for Amlogic devices on Linux. The aml_spisg_probe() routine allocates controller resources but, on several error paths, does not release them, leading to a memory leak. As the kernel continues to fail at probing, more memory is consumed until the system runs out of memory, causing a denial of service. The weakness is a heap memory management flaw (CWE-772).

Linux kernel, all builds that include the amlogic-spisg driver. The driver is part of the mainline kernel; therefore any distribution shipping a kernel that contains this code is affected until the fix is incorporated. Specific version information is not enumerated, so all affected releases prior to the patch should be considered vulnerable.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of active exploitation. Nevertheless, the impact is non‑trivial because a local or potential remote attacker who can cause the driver to fail during probe could force a memory‑exhaustion attack, resulting in a system reboot or crash. The fix replaces static allocation with device‑managed allocation, making the resources automatically released on error. The recommended action is to apply the patched kernel as soon as it is available.