This vulnerability arises from a memory leak in the Renesas I3C master driver of the Linux kernel. The xfer structure allocated during an I3C transfer is never freed, causing the kernel to consume more and more memory each time a transfer is performed. This resource exhaustion can eventually lead to the system becoming unresponsive or crashing, resulting in a denial‑of‑service. The weakness is classed as missing resource deallocation (CWE‑401) and a failure to free memory (CWE‑763).

All Linux kernel builds that contain the unpatched Renesas I3C master driver are potentially exposed. The fix is applied in recent kernel commits referenced in the advisory; therefore any kernel version before those commits is affected. Administrators should verify that their running kernel includes the patch commits or upgrade to a newer release.

The attack requires an ability to trigger I3C transfers against the kernel. Very low EPSS (<1%) and CVSS 5.5 moderate severity imply limited exploitation likelihood. The vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. Based on the description, it is inferred that the attacker would need local or privileged access to initiate the I3C transfers, as the interface is normally confined to the device’s operating system context.