In the Linux kernel the MCTP driver retains an unnecessary reference to a USB device during the probe routine and fails to release it on probe failure. The result is a resource leak that can gradually accumulate until memory pressure causes system instability. The weakness corresponds to missing resource recovery and logical error. The vulnerability does not provide direct code execution but can degrade system reliability and availability over time.

The flaw exists in the Linux kernel's MCTP driver, affecting all kernel releases that include the buggy driver prior to the published fix. The vendor is the Linux kernel project and the affected product is the Linux kernel itself. No exact version numbers are supplied, so any kernel version before the patch should be treated as vulnerable.

The risk of exploitation is moderate because the leak can lead to memory exhaustion. Because it is a kernel-level driver, the attack vector is local; a local user with the ability to probe MCTP devices could trigger the leak repeatedly. There is no evidence of remote exploitation or elevated privileges being required beyond local access. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The CVSS score is not provided, but the impact is limited to resource depletion rather than immediate confidentiality or integrity compromise.