The Linux kernel’s cx231xx media driver was holding device‑managed resources on the USB device itself, rather than on the USB interface; as a result, when the driver was unbound—such as during probe deferral or configuration changes—those resources were never released. The vendor’s commit fixes this lifetime mismanagement so that all devres are freed when the driver is unbound. While the description does not state a failure mode directly, it is inferred that the accumulated unreleased memory could grow unchecked during repeated unbind cycles, potentially exhausting system memory and causing a kernel crash or overall denial of service.

All Linux kernel builds that include the legacy CX231XX media driver before the devres lifetime patch are affected. This encompasses every distribution that ships a kernel with the unpatched driver, regardless of release channel, until the kernel is updated to incorporate the commit fixing the lifetime issue.

The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The severity is quantified by a CVSS score of 5.5, which denotes a medium impact. The likely attack vector requires local privileged execution to trigger driver unbinding or USB configuration changes, so the risk is primarily for local attackers who can force the driver to unbind, potentially leading to memory exhaustion. The vulnerability is not listed in the CISA KEV catalog, and no public exploitation has been reported to date.