The Linux kernel driver for CX23885 audio hardware contains a flaw where an error path fails to call cx23885_alsa_dma_unmap(), leaving a DMA mapping unreleased. This leads to a resource leak; subsequent attempts to map or use the device may fail, potentially corrupting memory or exhausting kernel address space. The impact is that an attacker who can control the driver’s initialization or can trigger repeated failures could cause the system to become unstable or crash, affecting availability.

All Linux kernel installations that include the media driver cx23885, regardless of vendor. Any system running an older kernel that uses the cx23885 module is potentially affected; the problem does not appear to affect other drivers.

This flaw involves the missing release of a DMA mapping, corresponding to CWE-772, a missing delete or release resource weakness. No public exploit has been reported and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score of 0.00032, indicating a very low exploitation probability, suggests the risk of exploitation is unlikely but not impossible. Because the flaw can lead to system instability or denial of service, it should be treated with caution. The CVSS score of 5.5 indicates a medium risk level. The impact depends on whether the affected device is actively used; a server without CX23885 hardware is not impacted even if the driver remains compiled.