The stm32-dcmipp media driver forgets to return queued buffers when start_streaming() fails. This causes the vb2 framework to retain references to the buffers, creating a memory/resource leak. In an attack scenario, repeated failures could exhaust available memory or buffer credits, potentially crashing or degrading system performance. The vulnerability represents a classic resource exhaustion flaw.

This flaw is present in the Linux kernel media subsystem, specifically within the stm32-dcmipp driver. No version range is disclosed, so any kernel builds containing the unpatched driver are potentially affected.

The CVSS score is not listed; the EPSS is unavailable and it is not in the KEV catalog. Even without quantified metrics, the attack vector is inferred to be local or privileged: an attacker who can invoke the driver’s start_streaming() (for example through a device file) could trigger the failure path. The resulting resource leak could lead to denial of service, so the risk is non‑negligible for systems that use the affected driver.