The vulnerability resides in the Meson video decoding driver of the Linux kernel. During the device open routine, a failure in control initialization bypassed proper context release, leaving orphaned kernel memory objects. This results in a cumulative memory leak that can grow each time the device is opened. The leak is a direct loss of kernel resources. If an attacker or a misbehaving application repeatedly opens the video decode device, the leaked memory cannot be reclaimed until a reboot or kernel crash occurs. Over time, this can degrade system performance, trigger out‑of‑memory kills, or culminate in a kernel failure, effectively denying service for the host or other processes. A likely attack vector is a local or privileged user who can open the /dev/v4l2 device; repeated or automated accesses could trigger the leak. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but the fixed path indicates the kernel community promptly addressed it, suggesting that a patched kernel is the only reliable protection.

All Linux kernel builds that include the Meson video decode driver before the patch, across any distribution that ships the default kernel image. No specific affected patch level is listed; the issue applies broadly until the kernel code is updated to the commit that introduces the err_m2m_ctx_release label, which should be present in recent stable kernel releases.

The CVSS score is unspecified, but the nature of the defect—an uncontrolled memory leak—implies a potentially high severity for systems that rely on continuous video decoding. Although exploitation requires the ability to open the relevant device, such access is typically granted to standard users on many systems. Once triggered, the leak can accumulate over time, increasing the likelihood of a denials of service, especially under high load or with persistence. Because the vulnerability has been fixed in the kernel source, upgrading to a kernel that includes the patch mitigates the risk.