The vulnerability occurs in the Nuvoton npcm-video driver of the Linux kernel. On probe failure or when the driver is removed, the allocated npcm_video structure is never freed, and the reserved memory association established by of_reserved_mem_device_init is not released on setup failure. These unchecked allocations cause kernel memory exhaustion over time, potentially degrading system stability or leading to denial of service. The weakness is a classic memory leak (CWE‑401).

All Linux kernel configurations that include the npcm‑video driver, prior to the patch that adds the missing kfree and of_reserved_mem_device_release calls, are affected. No specific version ranges are enumerated, so any kernel build with the old driver code is potentially vulnerable.

The CVSS score is not disclosed and the EPSS score is unavailable; the vulnerability is not listed in CISA KEV. Because it depends on driver load or probe failures, it requires local or privileged access and is unlikely to be exploited remotely. However, repeated probe failures or intentional driver unloading could lead to resource exhaustion and a denial of service. The exploitation path involves triggering probe failures or failure of npcm_video_setup_video, which causes unfreed memory to accumulate in kernel memory space.