The sun4i-gpadc-iio driver in the Linux kernel fails to clean up allocated resources when thermal zone registration fails. If devm_thermal_of_zone_register() returns an error, the probe returns without releasing the IIO map array or disabling runtime power management. This leads to a leak of kernel memory and stale references in the driver, potentially causing kernel instability or a denial of service after repeated failures, a flaw classified as CWE-749 and CWE-772.

This vulnerability affects any Linux kernel that includes the sun4i-gpadc-iio driver before the patch. Devices running earlier kernel releases that provide this driver are potentially impacted. The vendor is Linux kernel, and the specific versions are not listed in the advisory, so any kernel prior to the fix is considered vulnerable.

The CVSS score is 2.3 and the EPSS score is < 1%. The CVE is not in the CISA KEV catalog. The flaw can be exploited only if an attacker can trigger the failed thermal zone registration, which typically requires local access or control over device tree configuration. While the likelihood of remote exploitation is low, repeated failures may exhaust kernel memory or destabilize the system, resulting in a denial of service. The overall risk is moderate due to the limited attack surface and the need for local privileges.