The Linux kernel’s MMC subsystem for Aspeed SDHCI controllers contains a flaw where child device nodes are not unregistered before the parent clock and associated resources are released during probe failure or driver removal. This orphaning of child SDHCI devices can lead to residual device objects remaining in the system, potentially causing unstable device operation or unintended kernel behavior. The vulnerability specifically concerns improper deinitialization of device topology.

Systems running Linux kernels that include the mmc: sdhci-of-aspeed driver on hardware with Aspeed SDHCI controllers are affected. All kernel releases built from source before the patch that removes the defect are vulnerable, regardless of distribution or version number.

The EPSS score of <1% indicates a very low probability of exploitation, and the omission of a KEV listing suggests no publicly known exploit. The flaw requires driver probe failure or module removal, which implies a local or privileged attacker with access to kernel module operations could trigger it. While the description does not state that a kernel panic is guaranteed, the improper resource cleanup could lead to system instability or device malfunction. The CVSS score of 5.5 indicates moderate severity, representing a moderate risk in environments with vulnerable devices.