A defect in the Linux kernel media driver for the OV8856 camera sensor over I2C causes the control handler to remain allocated when the driver fails to add controls. The missing deallocation is a classic resource‑leak scenario, matching CWE‑772. The unreleased memory can accumulate over repeated initializations, potentially exhausting kernel address space or causing system instability, consistent with the CWE‑908 weakness regarding improper error handling. The CVE description itself does not claim a denial of service but the consequence of unbounded kernel memory usage logically implies one.

Any Linux installation whose kernel includes the OV8856 driver module is affected. The issue exists in kernel versions that have not yet incorporated the patch that adds an error exit path and frees the control handler. This includes both monolithic and modular kernel builds, regardless of distribution vendor.

The CVSS score of 5.5 indicates medium severity, while the EPSS score of less than 1% shows a very low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local access to repeatedly trigger the driver’s init path, leading to memory exhaustion. Based on the description, the most probable attack vector is local, inferred because the flaw manifests during driver initialization on the host system.