The saa7134 driver contains a flaw in its initialization routine where failures of two memory allocation functions are ignored. The driver continues as if the allocations succeeded, leaving an invalid page table and potentially never freeing allocated memory if subsequent steps fail. This oversight results in memory leaks, uninitialised DMA resources, and unreleased kernel objects such as control handlers. The weakness is reflected by CWE‑772.

Any Linux kernel that includes the saa7134 media driver and has not received the patch committed in 134c979dd721e22f196d71026432ee37d5f5cc38 is vulnerable. The exact kernel versions are not enumerated, so all releases prior to the application of that commit should be treated as susceptible unless a later patch version is installed.

The EPSS score of less than 1% indicates a very low probability of exploitation, and the CVSS score of 5.5 denotes moderate severity. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires loading the saa7134 module or triggering a device probe that exercises the faulty allocation paths, which typically requires privileged access. An attacker could repeatedly provoke allocation failures to exhaust kernel memory and force a denial‑of‑service, but this would need local privileged execution or the presence of vulnerable hardware. Overall, the risk is moderate; the flaw does not provide an arbitrary code execution path but can degrade system stability when repeatedly triggered.