A memory leak in the ASoC SOF topology loader of the Linux kernel arises from an improperly handled error condition, a CWE-772 weakness that occurs when the function returns –EINVAL without freeing previously allocated tplg_files. The loader will leak memory each time a topology file containing the string "dummy" is loaded when the template count is zero. Repeated load attempts may consume additional memory until the system exhausts its RAM, resulting in a denial‑of‑service via memory exhaustion.

All Linux kernel builds that contain the original snd_sof_load_topology implementation prior to commit 6ed7787c43ecf4ae27a3e700cab53a1ed646c7f8 (and earlier references d46f9f23897261da53ffbeb89d48a13982ba7d28) are vulnerable. Any distribution or custom kernel lacking the memory‑cleanup patch is affected.

The EPSS score is less than 1% indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 classifies it as moderate severity. Exploitation requires a local or privileged process capable of triggering topology loading; repeated use could lead to memory exhaustion, but the overall risk remains low due to the low exploitation probability.