The sm501 driver in the Linux kernel contains a reference‑leak flaw that occurs when platform_device_register() fails during sm501_register_device(). The device structure is initialized but the failure path returns without dropping the reference, causing a resource leak that can accumulate over time. This unchecked growth can exhaust kernel memory. The weakness is represented by CWE‑772.

The sm501 driver resides in the Linux kernel source. Only Linux kernels that include and load the sm501 driver are affected. The exact version range is not specified, so administrators should identify whether their kernel build loads or compiles this driver to assess risk.

The EPSS score is listed as < 1 %, and the CVSS score is 5.5, indicating a moderate level of severity but a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require repeatedly triggering sm501_device registration failures, which typically requires local privilege or the ability to cause such failures.Based on the description, it is inferred that the attack vector involves local privilege or the ability to cause registration failures. No known remote trigger exists, so the risk to externally exposed systems remains low.