This vulnerability exists in the Linux kernel media subsystem for the si476x radio driver. During device probe, the driver registers a V4L2 device before allocating controls and registering the video device. If any subsequent allocation or registration fails, the probe exits without unregistering the V4L2 device, leaving a dangling parent device reference. The result is an unreleased kernel resource that can lead to memory exhaustion or kernel instability, effectively causing denial of service.

All Linux kernel versions that include the unpatched si476x radio driver are affected. The fix is present in commits linked in the advisory. Systems that load the si476x_radio driver and have not upgraded to a version containing the patch are vulnerable.

The CVSS calculation is absent and EPSS is not available, so the exact risk level cannot be quantified. The bug is not currently listed in CISA's KEV catalog, indicating no known widespread exploitation. The most likely attack vector is local: an attacker with physical or firmware access can trigger probe failures or manipulate device initialization to exercise the error path, potentially causing a kernel crash or resource depletion. No remote exploitation path is documented.