The Linux kernel’s media/pci dm1105 driver failed to free an allocated workqueue when the device was removed, causing a memory leak and potential resource exhaustion. This weakness corresponds to CWE‑401 and could lead to denial of service if an attacker can repeatedly create and remove dm1105 devices, draining kernel memory. The flaw does not grant arbitrary code execution or privilege escalation but reduces system stability.

This issue is present in the Linux kernel’s media/pci dm1105 driver in all builds where the fault is present. The specific kernel releases affected are not enumerated in the advisory, so any distribution that has not applied the patch may be vulnerable. The fix requires a kernel update that includes the removal callback change.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a lower, but still significant risk level. Without a publicly available exploit, the likelihood of exploitation remains uncertain. The attack vector would most likely involve a local user with the ability to load and unload the dm1105 device driver, as the failure occurs in the device’s removal routine. To mitigate risk, applying the kernel update is recommended. If not immediately possible, monitoring memory consumption and restricting privileged users from manipulating the driver can reduce the attack surface.