The Linux kernel media driver for pwc contains a flaw in its start_streaming() routine: when an isochronous URB fails to submit, the error path drains only the queued buffers but neglects the buffer stored in the driver’s fill_buf field, causing a memory leak and triggering a WARN_ON inside vb2_start_streaming(). The vulnerability does not allow code execution or data exposure; repeated exploitation could exhaust kernel memory and lead to a kernel panic or denial of service.

Any Linux kernel installation that contains the pwc media driver and uses the vulnerable code path prior to the patch that drains the fill_buf on start_streaming() failure is affected. The vulnerability applies to all vendor releases that ship the pwc driver without the fix commit 80b0963e1698 and is not limited to a particular kernel version.

The flaw is local and requires privileged access to the kernel or to the device interacting with the pwc driver. Exploitation would need to trigger a start_streaming() failure to drain the buffer. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a low to moderate exploitation likelihood. While no remote attack vector is documented, the impact is limited to memory exhaustion and kernel instability within the local system.