This vulnerability is a memory leak in the Linux kernel’s radio-keene driver, occurring when the usb_keene_probe() function initializes the v4l2 control handler but later fails during device registration. The control handler is never freed in that error path, causing memory consumption to accumulate with each failure. This is a CWE-772 (Unreleased Resource) and CWE-401 (Memory Leak), and if an attacker can repeatedly trigger this failure the kernel could exhaust available memory, leading to a denial‑of‑service condition. No evidence indicates that the flaw permits arbitrary code execution or direct data disclosure.

All Linux operating systems that include the radio‑keene driver in the kernel are affected, regardless of distribution or version, until the patch is applied. The vulnerability is present in any kernel that contains the unsupported driver and could impact embedded devices, servers, or desktops using compatible USB radio hardware.

The CVSS score is 5.5; EPSS score is <1%, reflecting a very low probability of exploitation, and the issue is not listed in CISA KEV. The memory leak presents a moderate to high risk of DoS if an attacker can supply a malicious USB device that repeatedly triggers the probe failure. The most likely attack vector is local via USB hardware insertion; however, masquerading a device as a legitimate radio peripheral could also allow the exploitation. Because the flaw does not grant direct code execution, the immediate threat is limited to service availability rather than full system compromise.