The Linux kernel’s IPU6 media driver contains a bug in ipu6_pci_probe() where error paths skip a pm_runtime_put_sync() call, leaving a runtime power‑management reference undisposed. This results in a non‑decremented reference count that can grow each time the probe fails, potentially exhausting kernel resources. The vulnerability does not grant code execution or privilege escalation, but it weakens system availability by increasing kernel memory pressure and risk of instability.

Systems running Linux kernels that include the IPU6 media driver are affected. The advisory does not enumerate specific kernel versions; the patch applies to upstream releases that contain the modified ipu6_pci_probe() routine. Thus any kernel build that includes the legacy implementation without the added runtime‑PM release is vulnerable.

The CVE entry does not provide an EPSS score or a KEV status, indicating that exploitation has not been observed. Based on the description, the likely attack vector is a local or privileged user that can induce probe failures on the IPU6 device, causing repeated unreleased references to accumulate. This can lead to resource exhaustion and could destabilize the system. The severity is moderate, as the flaw requires access to the PCI subsystem and does not allow arbitrary code execution.