The vulnerability involves the Linux kernel media airspy driver; when start_streaming() fails, queued buffers are not returned to the user space, causing a memory leak in the kernel. The result is a loss of memory resources that can degrade system performance or lead to crashes, and the kernel emits a warning when the counter of buffers owned by the driver is non-zero. This weakness is a classic memory‑leak flaw. The likely attack surface is local; an attacker who can interact with the V4L2 airspy device (typically requiring user or root privileges) could trigger the failing start_streaming() call by disconnecting a USB device or otherwise forcing an error path, thereby exhausting kernel memory over time.

Affected systems are Linux kernel deployments that include the airspy media driver. No specific kernel versions are enumerated in the data; the issue is operative in any kernel that contains the unpatched airspy code path.

The EPSS score of 0.00209 (approximately 0.2%) and its absence from the CISA KEV catalog indicate a very low likelihood of exploitation. The CVSS score of 3.3 indicates low severity. However, because the flaw can lead to kernel memory exhaustion, the severity can be high when exploited. Exploitation requires channeling an error in start_streaming(), which is generally limited to local users with access to the airspy device; thus privilege escalation could elevate the risk. The impact is primarily availability, with secondary confidentiality and integrity risks if repeated memory exhaustion leads to system instability.