The flaw involves mis‑associating a devres group and IRQ requests to an intermediate per‑port structure instead of the long‑lived parent device. This prevents the kernel’s devres framework from tearing down the resources together, potentially leaving dangling memory allocations or unused IRQ lines. Over time, repeated mismanagement may exhaust kernel memory or deplete interrupt line resources, triggering a kernel crash and a denial of service. The weakness corresponds to improper resource management (CWE‑772).

All Linux kernel builds that compile the EDAC/altera EDAC driver without the patch are impacted. This includes standard Linux distributions shipping kernels with the EDAC subsystem for Altera hardware, and kernels released before the commit that introduced the fix remain vulnerable.

The EPSS score shows a very low but non‑zero exploitation probability, and the CVSS score of 4.4 indicates a moderate severity. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local privileged access or the ability to load or reload the affected driver; remote exploitation is unlikely without additional compromise. An attacker with kernel privileges could repeatedly trigger the flawed setup routine, causing resource exhaustion and a service interruption.