The Linux kernel's media driver for Iris Gen1 hardware fails to release internal buffers after the firmware signals that they are no longer needed. The driver therefore retains stale memory allocations that are no longer used, especially when the device changes resolution and new buffers are allocated. As a result, kernel memory usage grows until the session ends, which can lead to resource exhaustion. This flaw is classified as CWE‑401 (Memory Management) and CWE‑772 (Resource Leak).

All systems running a Linux kernel that includes the Iris Gen1 media driver are affected. The version information is not specified in the advisory, but the bug resides in the driver module that is part of the media subsystem. Any system that actively uses iris Gen1 modules—for example, for hardware‑accelerated camera or video capture—may be impacted by the buffer leakage.

The vulnerability is not listed in CISA KEV, and the EPSS score is less than 1%, indicating a low likelihood of exploitation. The CVSS score is 5.5, reflecting a medium severity. The likely attack vector is local: a user or process that interacts with the device (e.g., changing camera resolution) triggers the buffer allocation and release cycle. Because the flaw does not provide privilege escalation or remote code execution, the primary risk is a denial‑of‑service via gradual memory exhaustion on systems with limited resources.