During module initialization the I3C bus notifier is registered and existing I3C buses are enumerated. If the subsequent device driver registration fails, the function returns immediately without freeing the state it created. As a result the notifier remains registered, the bus objects that were added remain allocated, and the notifier holds a reference to a module that failed to load. This improper cleanup causes a memory leak and leaves a dangling reference, potentially leading to resource exhaustion over time.

All versions of the Linux kernel that contain the mctp i3c driver prior to the patch that resolves this issue. No specific vendor or product version is listed, so any distribution using a kernel with the vulnerable code is potentially affected.

The flaw can be triggered during module loading, so an attacker with local privileged access who can load kernel modules can intentionally cause the failure and the ensuing leak. Because the defect leads only to memory/resource exhaustion rather than arbitrary code execution, it is a high‑risk issue for availability. The EPSS score is <1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. There is no publicly documented exploit yet. The CVSS score of 7.8 indicates high severity.