In the Linux kernel, the routine avs_pci_probe is responsible for probing Intel AVS sound devices. If the helper function snd_hdac_ext_bus_get_ml_capabilities returns an error, the code as written ignores that result and proceeds without properly cleaning up the bus resources. When it succeeds but a later part of avs_pci_probe fails, the allocated hlink list is also left unreleased. These gaps mean that partially initialized bus structures or hlink entries can remain in memory, causing a memory/resource leak that can accumulate over time and degrade system stability.

The vulnerability affects any Linux kernel that includes the Intel AVS (Audio System on Chip) driver and has not been patched to include the correct error‑path cleanup. This includes all current mainline kernel releases until the commit that implements the cleanup is merged, as the affected code resides in the kernel source tree under the ASOC subsystem.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% points to a low probability of exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the bug requires local or privileged access to trigger a probe failure; remote exploitation is unlikely without additional privilege escalation. The primary effect is a non‑remediated memory leak, which could lead to resource exhaustion or system instability over prolonged operation.