The Linux kernel’s media/pci dm1105 driver failed to free an allocated workqueue when the device was removed, causing a memory leak and potential resource exhaustion. This weakness corresponds to CWE‑772 and could lead to denial of service if an attacker can repeatedly create and remove dm1105 devices, draining kernel memory. The flaw does not grant arbitrary code execution or privilege escalation but reduces system stability.

This issue is present in the Linux kernel’s media/pci dm1105 driver in all builds where the fault is present. The specific kernel releases affected are not enumerated in the advisory, so any distribution that has not applied the patch may be vulnerable. The fix requires a kernel update that includes the removal callback change.

The EPSS score of less than 1% and absence from the CISA KEV catalog suggest low to moderate exploitation likelihood. The CVSS score of 4.4 indicates moderate severity. While no public exploit is known, the vulnerability could be leveraged by a local user with permission to load or unload dm1105 driver; this inference is based on the fact that the leak occurs during the device’s remove callback. Consequently, the primary risk is the potential for kernel memory exhaustion leading to denial‑of‑service if an attacker repeatedly attaches and detaches the device. Mitigation therefore focuses on applying the kernel patch, restricting privileged users, and monitoring memory usage.