The ipw2100 driver for Intel Wi‑Fi chipsets in the Linux kernel suffers from a memory leak and improper resource release (CWE‑772) that occurs when the PCI initialization function ipw2100_pci_init_one() fails to enable the device. Memory allocated by ipw2100_alloc_device() is not freed on several error paths, allowing the driver to consume RAM until the system is exhausted. An attacker that can trigger this failure will experience a denial of service, with the operating system becoming unstable or crashing as memory resources are depleted.

All Linux kernel releases that contain the ipw2100 driver before the commit that implements the fix are affected. The driver is part of the mainline kernel tree, so any distribution using that kernel code without the patch is vulnerable. The exact version range is not specified, but the patch was applied following the commits linked in the references, meaning any kernel built from sources before those commits will be susceptible.

The CVSS score of 5.9 classifies this issue as medium severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation is documented. Because the memory leak can only be triggered during driver initialization, the likely attack vector is local or requires elevated privileges; it could be triggered remotely if an attacker can cause a forced re‑initialization of the device through a privileged application or kernel module. For most users the risk remains moderate, but host systems that are exposed to high‑privilege services or that allow users to manipulate PCI device states may face a higher threat.