In the Linux kernel’s comedi driver, the runflags flag is insufficiently inspected during an exceptional exit of do_cmd_ioctl(). When runflags is not set, do_become_nonbusy() fails to release the chanlist memory, causing a memory leak. This flaw is a CWE-911 weakness. Repeated invocations of the problematic ioctl path will continually exhaust kernel memory, potentially degrading performance or causing the system to become unresponsive.

All Linux kernel releases that ship with the comedi driver but do not include commit 4e1da516debb. Distributions that have not applied this reference‑counting patch are affected.

The likeliest attack vector is a local attacker who can access the comedi device to repeatedly trigger the ioctl interface. Because the flaw is a memory leak rather than an elevation of privilege or remote code execution, broad exploitation is unlikely in generic scenarios, yet environments with trusted users or automated scripts can accelerate memory exhaustion and provoke a denial‑of‑service event. EPSS data is not available and the issue is not listed in CISA KEV, but the absence of a publicly known exploit does not reduce the potential impact of sustained leaking.