The amlogic-spisg driver in the Linux kernel contains a memory leak in its probe routine because a controller allocation is not released when probe errors occur. Each time the driver fails to initialize, the allocated memory remains in kernel space, leading to a gradual depletion of available memory. Although the defect does not provide a direct path to remote code execution or privilege escalation, repeated probe failures can destabilize the system or cause a denial of service through exhaustion of kernel memory resources.

All Linux kernel releases that include the amlogic-spisg driver before the patch that replaced aml_spisg_probe() with devm-managed allocations are affected. The advisory does not list exact version numbers; administrators should check whether their kernel contains the upstream commit that introduces the devm_spi_alloc_* calls. The vulnerability is therefore present in any kernel build that has not incorporated this change.

The CVSS score is not supplied and EPSS data is unavailable, indicating limited publicly known exploitation. The bug is not listed in the CISA KEV catalog. Exploitation requires the ability to trigger repeated probe failures, which generally implies local control or the capability to influence device initialization. Consequently the risk profile is moderate, primarily representing a local denial-of-service scenario rather than a remote attack vector.