Because the driver’s cleanup logic only calls the generic IRQ domain removal function without explicitly invoking the function that releases the allocated chip data, the memory allocated for those chips persists. The missing release of a global resource (CWE‑772) results in a kernel‑level memory leak that can grow over time, potentially exhausting system memory or causing a denial‑of‑service condition if the device is repeatedly unbound.

Affected systems are all Linux kernel deployments that include the mvebu GPIO driver, regardless of distribution. No specific kernel version list is provided, but any kernel revision prior to the commit that introduces the fix (e.g., 3649b04f) would be susceptible. The driver is part of the kernel’s built‑in architecture for Marvell ARM SoC based boards.

The EPSS score of < 1 % and absence from CISA KEV indicate that widespread exploitation has not been observed. However, because the flaw is triggered by a privileged unbind operation, a local attacker with sufficient privileges can repeatedly unbind and rebind the device to cause escalating kernel memory consumption, potentially leading to a denial‑of‑service condition. With a CVSS score of 5.5 the vulnerability is of moderate severity; the risk is higher on systems that require high availability or that allow frequent device unbinding. The likely attack vector is an unbind operation on a mvebu GPIO device, which may be triggered by an administrator or an attacker with elevated privileges.