The Linux kernel media driver for the ov5647 camera module was modified to fix a reference‑count leak that could cause the runtime power management to accumulate unreleased references across three control cases: AUTOGAIN, EXPOSURE_AUTO, and ANALOGUE_GAIN. Because the driver returned early without decrementing the runtime PM counter, repeated use of these controls could inflate the reference count permanently, locking the device in a powered‑on state or exhausting kernel resources. This flaw is a classic resource‑leak weakness, reflected in NVD-CWE-Other and is also associated with CWE‑911.

Any system running the Linux kernel with the ov5647 I2C driver prior to the application of the fix is potentially affected. The vendor of the affected component is the Linux Kernel project; no specific kernel release range is given in the advisory, so all kernel versions that incorporated the vulnerable driver code before the patch should be considered at risk.

The exploitation of this vulnerability is constrained to environments where the flawed driver code can be exercised. It is inferred that an attacker with privileged or local access could trigger the problematic controls repeatedly to accumulate reference counts until the runtime PM subsystem can no longer release the device, effectively causing a denial‑of‑service. The EPSS score of 0.00024 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, but the potential for a local resource exhaustion attack remains.