During initialization of the Linux media vivid driver, a failure in platform_device_register() leaves an initialized device reference unreleased, creating a reference leak. A separate code path incorrectly calls platform_driver_register() during cleanup, preventing the driver from being unregistered when a workqueue fails. These bugs can cause kernel memory or resource exhaustion, potentially destabilizing the system. The vulnerabilities are identified as resource leakage issues (such as memory leaks) in the device registration and cleanup code paths.

The issue arises in all Linux kernel releases that include the vivid media driver before the patch. Vendors such as Linux distributions that ship the affected kernel version are impacted. The vendor product is the Linux kernel itself, specifically the media/vivid driver module. No specific kernel version range is listed, so any kernel containing the unpatched vivid driver is vulnerable.

The CVSS score is not provided, but the EPSS score of < 1% and absence from the CISA KEV catalog suggest a comparatively lower mainstream exploitation probability. The vulnerability requires a local context that can trigger the vivid driver’s initialization failure, for example by loading the driver or interacting with its device interface. An attacker who can repeatedly provoke the failure path may exhaust kernel references or memory, leading to a denial of service or instability. The risk is therefore moderate to high for systems that load this driver and are exposed to untrusted input or modules.