The Linux kernel MCTP driver holds a USB device reference during its probe process and fails to release it when the probe fails, causing a memory and resource leak. This leak can accumulate with each probe failure, leading to increased memory consumption and possible system instability over time.

The flaw exists in the Linux kernel’s MCTP driver in all releases prior to the patch. Kernel versions less than the one containing the fix, regardless of release candidate, are vulnerable. No specific version numbers are listed, so any kernel assembly that shipped the unpatched driver before the update should be considered at risk.

The vulnerability has a CVSS score of 5.5, indicating medium severity and primarily a resource exhaustion impact. The EPSS score of <1% suggests a low likelihood of exploitation in the wild, and the flaw is not present in the CISA KEV catalog. The description does not specify an attack vector; however, the leak occurs during the MCTP probe, implying that an attacker would need local access to initiate a probe sequence. The resulting leak is non‑privilege‑escalating but may affect overall system stability if repeated probe failures occur.