A flaw in the Linux kernel’s wave5 VPU driver causes a memory leak when the codec_info allocation fails during instance initialization. The previously allocated VPU instance is never freed, resulting in unreleased kernel memory that can accumulate over time. While this bug does not grant code execution, repeated failures can exhaust kernel memory and degrade system performance or trigger a kernel panic, effectively creating a denial‑of‑service condition. The weakness is a classic example of improper resource deallocation.

The issue affects the Linux kernel component that implements the wave5 VPU driver. No specific kernel version range is provided, so any kernel where this driver has been built without the patch can be impacted.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. The attack vector is limited to paths that invoke the wave5 codec opening routines, which typically require a user or privileged context that calls the driver. The impact remains local to the affected host, but the lack of a memory cleanup can lead to resource exhaustion if the failure path is hit repeatedly. Because of the absence of a readily exploitable code path, the overall risk is considered moderate, with the primary concern being the potential for service degradation rather than immediate compromise.