In the Linux kernel, the dw_i3c_master_i2c_xfers() function allocates a transfer structure but fails to free it when pm_runtime_resume_and_get() fails. This oversight creates a memory leak that can be triggered every time the i3c device controller performs an I2C transfer that encounters a runtime resume error. As the leaked memory accumulates, system memory pressure increases, potentially leading to degraded performance or a system crash, thereby causing a denial‑of‑service condition. The Weakness is a classic memory‑leak scenario and does not directly provide code execution or privilege escalation.

The vulnerability affects all Linux kernels that include the dw i3c driver. No specific kernel versions are listed, so the issue may exist across multiple releases that compile the current dw_i3c master code.

The CVSS or EPSS metrics are not available, but the nature of the flaw suggests a high exploitation likelihood in environments where the i3c driver handles frequent I2C transfers. Because the vulnerability is in kernel space, a successful exploitation would require interaction with the affected device, likely in a privileged or controlled context. The issue is not listed in the CISA KEV catalog, indicating that there are no known active exploits, yet the potential for service disruption warrants prompt remediation.