During initialization of the remoteproc qcom subsystem in the Linux kernel, an error handling path fails to free a dynamically allocated name string when the addition of a custom minidump segment is aborted. This creates an unreleased memory buffer that is never reclaimed by the cleanup routine. If the function is repeatedly called, the leaked buffers accumulate, potentially exhausting kernel memory and leading to system instability or denial of service.

The affected component is the remoteproc qcom driver within the Linux kernel. The CNA data lists the generic Linux kernel as the vendor, implying that any kernel that includes this driver—such as mainstream distributions or custom builds—may be affected until the upstream patch is integrated.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS value of <1% suggests a low probability of exploitation at present. This vulnerability is not included in CISA's KEV catalog. Based on the description, it is inferred that an attacker would need privileged kernel access or the ability to execute repeated calls to the qcom_add_minidump_segments() routine, which limits the attack surface to compromised or privileged systems. Consequently the overall risk is moderate for environments that use the affected component, and patching is recommended to prevent potential memory exhaustion.