The vulnerability exists in the Meson video decode driver of the Linux kernel. When the device is opened, a failure in the control initialization path bypassed the release of the media-to-media (m2m) context, leaving orphaned kernel memory allocated by the driver. Repeated failures could potentially lead to a cumulative memory leak that may exhaust kernel memory, an outcome inferred from the mechanism of the leak.

All Linux kernel builds that include the Meson video decode driver before the fix, regardless of distribution, are affected. The issue applies until the kernel source is updated with the err_m2m_ctx_release label introduced in the commit that addresses the leak.

The CVSS score is not provided; however, the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. A potential exploitation scenario would involve an attacker opening the relevant video device; it is inferred that /dev/v4l2 devices may be accessible to regular users on many systems, but this is not stated explicitly in the CVE description. While exploitation is unlikely, the memory leakage could accumulate over time, increasing the chance of a denial of service if the vulnerability is triggered repeatedly—this is an inference drawn from the nature of the leak. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.