The vulnerability is a resource leak in the cx25821 media driver for Linux. When the ioremap() call fails, the driver does not release the memory region obtained by cx25821_get_resources(), leaving a reserved region in the kernel’s address space. Over time this can exhaust kernel memory or prevent other devices from allocating resources, which may cause system instability or crashes.

All Linux kernel installations that include the cx25821 driver before the patch are impacted. No specific kernel versions are listed, so any kernel build containing this driver should be considered vulnerable until the fix is applied.

The CVSS score of 5.5 indicates moderate severity. No public exploits have been recorded and the vulnerability is not listed in CISA KEV, but the loss of a memory region can lead to denial of service if the condition repeats. Exploitation requires an adversary to trigger the driver’s initialization routine, which is typically a local or privileged action. The EPSS score of < 1% (approximately 0.00024) indicates a very low probability of exploitation. Administrators should treat the risk as moderate and install the patched kernel promptly.