The Linux kernel SDIO UART driver allocates a transmit FIFO buffer in sdio_uart_add_port. If the UART port table is already full, the function returns -EBUSY while leaving the FIFO still allocated. The probe error path frees only the port structure, so the FIFO remains in kernel memory, resulting in a memory leak. Because the failure path never releases the resource, repeated attempts to add UART ports can consume increasing amounts of kernel memory, potentially exhausting the pool reserved for the kernel (CWE-772).

Any Linux kernel that includes the SDIO UART driver and was compiled before the commit that adds the missing free operation is affected. The vulnerability is present in all builds that enable the sdio_uart module or load it as a built‑in component. Specific version ranges are not listed in the advisory, so any kernel version older than or equal to the commit that introduced the fix is at risk. All standard distributions using the upstream kernel sources are therefore impacted unless they have applied the patch.

The CVSS score is 5.5, indicating a moderate level of severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation is low. An attacker would need to have local or privileged access to the device in order to trigger repeated UART port additions, which would cause the memory leak cycle to repeat. While the exploitation vector is limited, the risk of resource exhaustion from sustained failures warrants monitoring, especially on hosts running high‑utilisation workloads.