The sca3000 Industrial I/O driver in the Linux kernel allocates an interrupt through request_threaded_irq during its probe routine. When iio_device_register fails, the allocated IRQ is not freed, creating a resource leak that is described as CWE‑772. It is inferred that repeated probe failures could eventually exhaust available IRQ resources, leading to a denial of service, although the CVE text does not explicitly confirm this outcome.

Any installation of the Linux kernel that includes the sca3000 driver and has not applied the patch that adds the error handler after a failed iio_device_register call is potentially affected. This includes all kernel branches that ship the unpatched sca3000 driver, but the advisory does not list specific kernel releases, so administrators must verify whether their kernel version contains the fix.

The CVSS score of 5.5 places the vulnerability in moderate severity, while the EPSS score of < 1% indicates a low likelihood of exploitation. The CVE is not listed in the CISA KEV catalog. Because the defect resides in internal driver initialization, the attack vector is inferred to be local—an attacker must be able to load or influence the driver during boot or module insertion to trigger the probe path and force a registration failure.