The Linux kernel's SPI driver for the CH341 controller performs device resource management incorrectly, causing resources to be tied to the USB device instead of the USB interface. When the driver is unbound, the associated resources are not released, leading to memory leaks. Over repeated rebind or probe‑deferral operations, these unfreed resources can accumulate, potentially exhausting system memory and degrading performance or triggering a denial of service. The primary weakness is a resource‑lifetime bug, which would be categorised as a memory‑leak issue.

All Linux kernel releases that include the CH341 SPI driver before the commit referenced in the CVE are potentially affected. No specific version range is supplied; affected builds are any kernel that has not incorporated the fixes hosted in the linked git commits.

Exploit probability is very low, with an EPSS score of less than 1%, and the vulnerability is not listed in CISA's KEV catalog. The CVSS score is 5.5, indicating moderate risk. The risk stems from its nature as a memory leak that could be exacerbated by repeated unbinding operations, which may be triggered by configuration changes or device probe deferrals. The attack vector is likely local or user‑initiated, as it requires interaction with the USB interface; it is inferred that an adversary with physical or privileged access could force unbind operations to cause the leak. No public exploit is documented, but the potential for resource exhaustion makes the vulnerability significant for long‑running or resource‑constrained systems.