In the Linux kernel GPIB USB driver, the function ni_usb_init() allocates a writes buffer that is not freed when the helper ni_usb_setup_init() fails. This memory leak in kernel space can gradually deplete available memory, potentially degrading performance or causing a kernel crash. Additionally, the function returns an incorrect error code (-EFAULT) when the helper fails, which may mislead callers about the failure reason and represents a CWE‑772 vulnerability.

All Linux kernel releases that include the unpatched GPIB USB driver. Any system running such a kernel version while the GPIB USB module is loaded is vulnerable.

The flaw does not provide remote code execution or privilege escalation. Exploitation requires local access to trigger the initialization path, such as by repeatedly opening the GPIB device from user space. Based on the description, it is inferred that an attacker with local privilege can repeatedly exercise the vulnerable path to exhaust kernel memory. The EPSS score of <1% indicates a very low probability of widespread exploitation. This issue is not listed in the CISA KEV catalog, and the overall risk is limited to memory exhaustion rather than direct data compromise.