The pl353 raw NAND driver has a flaw where, during probe(), it calls devm_ioremap() with the parent device instead of the device itself. This causes the memory mapping of the device registers to be associated with the wrong parent, so when the module is unloaded, that register area is not freed. The resulting kernel memory leak can accumulate over repeated load/unload cycles and may eventually exhaust available kernel memory, destabilizing the system. The weakness corresponds to CWE-772 Unreleased Resource.

Any Linux kernel that includes the pl353 raw NAND driver before the commit that fixes the probe logic. The affected kernel code is part of the generic mtd: rawnand: pl353 driver; specific version ranges are not listed in the CVE data, but all versions before the patch are vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local privileged access capable of loading/unloading kernel modules, which is typically reserved for system administrators or attackers with kernel or root access. The primary risk is resource exhaustion and potential system instability rather than immediate privilege escalation.