The Mediatek Gen3 PCI controller driver allocates IRQ domains before retrieving the controller’s IRQ. If IRQ retrieval fails, the function exits without freeing the allocated domains, resulting in a kernel resource leak. This leak consumes memory and other kernel resources over time and can eventually lead to a denial of service. The weakness is a classic resource management flaw, corresponding to CWE‑772.

All Linux kernel builds that integrate the Mediatek Gen3 PCI controller driver are affected until the issue is patched. The CPE list indicates the vulnerability applies to the Linux kernel as a whole. No specific kernel versions are enumerated, so any system running an unpatched kernel with this driver should be considered at risk.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % signals a very low likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation would require the attacker to either load the driver or trigger its initialization on a system where the Mediatek Gen3 PCI controller is present, which typically demands privileged access. Given the limited surface and low EPSS, the immediate threat is low, though repeated failures could degrade system stability.