The flaw is a reference‑count leak in the Linux kernel media driver for MediaTek chipset (mtk-mdp). During device probing, the driver obtains a reference to a platform device but never releases it when the device is removed. This results in a gradual increase in kernel memory usage; repeated probe and removal sequences can exhaust available memory or destabilize the kernel, potentially leading to a denial of service. The weakness is classified as a double reference count issue (CWE‑911). The vulnerability does not provide direct code execution or privilege escalation.

The vulnerability affects any Linux system that includes the generic Linux kernel with the mtk-mdp media driver enabled. Because no specific kernel version range was provided, all kernel builds prior to the patch that fixes the mtk_mdp_remove reference‑count bug may be impacted.

The CVSS score of 5.5 indicates moderate severity, and combined with the EPSS score of less than 1%, the likelihood of exploitation remains low. The vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been widely exploited. Based on the description, it is inferred that the attack vector requires local or kernel‑level interaction to trigger repeated probe and removal cycles, which makes the risk low to moderate for non‑privileged users. Immediate remediation by updating the kernel mitigates the potential for memory exhaustion and system instability.