The flaw occurs in the Linux kernel’s tw9903 I2C media driver during the probe routine. When an error path is taken, the control handler created by v4l2_ctrl_handler_init and v4l2_ctrl_new_std is not released, causing a repeated allocation that can drain kernel memory and potentially lead to a panic or a denial‑of‑service condition. The vulnerability does not grant code execution or privilege escalation.

The issue affects Linux kernel builds that ship the tw9903 driver and have not applied the commit that added v4l2_ctrl_handler_free to the error path. The vendor is the Linux kernel project; the fix is present in any mainline or stable kernel released after the changes referenced in the commit history. Older kernels without the commit remain vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is available. An attacker would need to trigger the probe error, which likely requires interaction with the tw9903 hardware or manipulating the module load sequence. As a result, the risk is limited to resource exhaustion and service interruption rather than active compromise.