A kernel media driver bug causes queued buffers to be left in memory when the streaming start routine fails. The leaked buffers are not returned to the buffer framework, producing a kernel warning and a persistent memory leak. This weakness is aligned with missing resource deallocation (e.g., CWE‑775). The impact is an unintended use of kernel memory that can degrade system availability and may lead to denial‑of‑service if the leak accumulates over time.

The flaw affects the Linux kernel media subsystem driver for USB Video Class devices (pwc). The specific kernel versions that contain the bug are not listed in the advisory, so administrators should consult the kernel release notes for the patch that implements the fix in the referenced commits.

Because the vulnerability arises during a standard device streaming operation, it is an in‑kernel issue that would typically require local access to the USB device and the ability to trigger start_streaming(). The risk level is moderate; an attacker could potentially exhaust memory and destabilise the system. No EPSS score is available, and the bug is not listed in CISA’s KEV catalog, indicating that it is not yet a known exploited vulnerability. The attacker would need to interact with the affected USB device, so remote exploitation is unlikely without additional privileges.