The vulnerability arises in the AFE driver for the Mediatek MT8183 platform within the Linux kernel. When the driver probes successfully it reserves memory using of_reserved_mem_device_init(), but the allocated memory is never released on driver removal or on subsequent probe failures. This oversight leads to a memory leak that can consume kernel memory over time, potentially exhausting system resources and causing instability or crashes. The weakness is a classic case of unreleased resources, with risk primarily of denial‑of‑service rather than direct compromise of confidentiality or integrity.

Any Linux kernel build that includes the Mediatek MT8183 AFE driver is affected. The issue is independent of OS distribution but applies to all devices that ship the MT8183 audio front‑end component with the unpatched driver code. No specific kernel or distribution versions were enumerated in the advisory, so all builds containing this driver prior to the patch are potentially vulnerable.

The CVSS score is not listed in the advisory, and the EPSS value is unavailable, so the quantitative risk cannot be expressed. The vulnerability is listed as not part of the CISA KEV catalog, suggesting no widespread, publicly known exploitation. However, the flaw is local‑privileged: any user with the ability to load or unload kernel modules on the affected device can exercise the driver’s probe or removal paths, leading to prolonged memory leakage. In the absence of more detailed metrics the risk is regarded as moderate, with the primary threat being resource exhaustion over time.