The vulnerability occurs in the Linux kernel’s tsi148 DMA bridge. During device removal or module unload, the code that cleans up the bridge does not free the list of location monitor resources, which were allocated during probe. This results in a memory leak where allocated resources remain dangling and are never reclaimed by the kernel. The leak can consume RAM over time and ultimately lead to resource exhaustion, potentially destabilizing the host. The weakness is improper resource handling (CWE-772).

All Linux kernel implementations that include the staging vme_user driver prior to the applied fix are affected. No specific kernel version range is enumerated, so any build that contains the vme_user driver and uses the tsi148 bridge without the downstream patch is considered vulnerable.

The exploitability of this flaw is limited to scenarios where the attacker can trigger device unbind or module unload events. It does not provide direct remote code execution or privilege escalation. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. While the resource leak can consume memory over time and potentially destabilize the host, it is unlikely to be actively exploited in the wild due to the low exploitation likelihood.