During driver initialization the Amlogic spifc-a4 SPI NAND flash controller registers an on-host ECC engine; however, if the probe fails or the device is later removed, the engine is never unregistered. This missing cleanup results in a kernel resource that remains allocated, which can degrade kernel stability or exhaust memory if repeatedly triggered. The weakness is a failure to release a resource.

The Linux kernel contains the spifc-a4 driver that implements this functionality. Any distribution running a kernel that includes the driver before the patch that adds a devm cleanup action is affected. The issue is present in all kernel versions that contain the unpatched driver code.

The CVSS score is 5.5, and the EPSS score is <1%. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploiting the resource leak requires local kernel access or the ability to repeatedly trigger probe failures or device removal, which makes remote exploitation unlikely. Nevertheless, repeated failures could lead to a denial of service if an attacker can repeatedly cause probe crashes.