The Linux kernel media subsystem driver for USB Video Class devices contains a defect where the start_streaming() routine can return an error before returning any queued video buffers. When the driver fails to call vb2_buffer_done() for these buffers, a warning is triggered and the memory they occupy leaks into the kernel heap. This missing deallocation is classified as CWE-772 and CWE-401, and can gradually consume kernel memory, potentially leading to instability or crashes.

The vulnerability affects the pwc driver within the Linux kernel media stack. No specific kernel version range is enumerated, but the resolution has been introduced in a series of commits that are incorporated into newer kernel releases. Administrators should confirm that their running kernel includes those commits; the relevant changes are documented in the kernel source changelog and the referenced commit series.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1 % reveals a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires local access to a USB video device and the ability to initiate a streaming session that triggers start_streaming(); remote exploitation without additional privileges is unlikely.