Technical impact
The stm32‑ospi driver contains a resource management flaw (CWE‑772) where its remove() callback exits prematurely if a power‑management resume request fails. This prevents the driver from releasing internal resources, creating a hidden memory or resource leak in the Linux kernel. Repeatedly unloading and reloading the driver could gradually deplete system resources, degrading performance or causing a denial of service. The issue is a kernel‑level flaw; exploitation requires control over the driver lifecycle and therefore elevated privileges. The only known mitigation is the upstream patch that removes the early return, ensuring cleanup runs regardless of resume success.
Affected Systems
The vulnerability affects any system running a Linux kernel that includes the stm32‑ospi driver. Exact kernel versions are not listed, but the problem is present in kernels prior to the patch commit. It is relevant to embedded devices, development boards, or custom kernels that use the STM32 OSPi peripheral controller.
Risk and Exploitability
The CVSS score is 5.5, indicating a moderate severity, and the EPSS score of less than 1% reflects a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The risk to a defender is moderate to high if the driver is frequently unloaded and reloaded in a compromised environment. The attack vector is inferred to be local with root or module‑loader privileges; no public exploits are documented. Mitigation is driven by applying the upstream patch rather than relying on the low probability of exploitation.
