A memory allocation performed during the initialization of the wwan iosm driver in ipc_protocol_init() is not released when the subsequent ipc_imem_init() fails. This failure route does not call the corresponding deinitialization function, which results in a gradual exhaustion of kernel memory each time the error path is exercised. The weakness is classified as resource exhaustion (CWE‑772) and can degrade overall system performance and stability over time.

All Linux kernel releases that include the wwan iosm driver before the patch that adds the deinitialization call to ipc_protocol_init() are affected. Typical distribution kernels shipping the driver prior to the indicated commit are vulnerable. No specific kernel version range is provided, so any kernel that contains the driver code before the fix is at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests that current exploitation attempts are unlikely. Based on the description, it is inferred that an attacker would need local privileged access or the ability to load the driver to exploit this vulnerability. The flaw is not listed in the CISA KEV catalog. Because the vulnerability resides in kernel space, exploitation would require local privileged access or the ability to load or interact with the driver; remote exploitation is not supported by the current description.