The Linux kernel media driver for si476x registers a V4L2 device before allocating its controls and before registering the video device. If any of those subsequent steps fail, the driver exits its probe routine without unregistering the V4L2 device, leaving a dangling parent device reference. Unreleased kernel resources can lead to memory exhaustion or kernel instability, resulting in a denial of service. The issue is a failure to release resources in the error path (CWE‑772).

All Linux kernel releases that include the unpatched si476x radio driver are affected. The vulnerability applies to systems that load this driver and have not upgraded to a kernel commit containing the fix. It does not affect kernels that have already applied the patch or systems where the driver is disabled.

The CVSS score is 4.4, indicating moderate severity, and the EPSS score is less than 1 %, reflecting a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread attacks. An attacker would most likely need local or firmware access to trigger a probe failure, and there is no documented remote exploitation path.