The Linux kernel media driver for NXP iMX8-ISi contains a flaw where the crossbar and pipe cleanup routines omit calls to v4l2_subdev_cleanup(), leaving the subdevice state allocated. This missing resource release causes a kernel memory leak every time the module is removed, as reported by kmemleak. The resulting unreferenced objects can accumulate, potentially exhausting kernel memory and leading to system instability.

All Linux kernel releases that include the media nxp imx8-isi driver before the patch adding v4l2_subdev_cleanup() in both crossbar and pipe cleanup paths are affected. Specific kernel version ranges are not provided in the available data.

The EPSS score of < 1% indicates a very low chance of current exploitation, and the flaw is not listed in the KEV catalog. The likely attack vector involves unloading the imx8-isi kernel module, a task that requires root or CAP_SYS_MODULE privileges; no remote or elevation vectors are described, so the vulnerability is considered locally exploitable. While it does not enable code execution or privilege escalation, repeated memory leaks could consume kernel memory, degrading reliability or causing crashes. The overall risk is deemed moderate for environments that routinely unload the driver, and low for systems where the driver remains loaded.