The EPSS score of 0.00128 badly understates the real hazard here. This isn't a typical resource leak — it's a dangling notifier that will cause a kernel panic when the I3C subsystem fires its bus events after the module load failure.
The core vulnerability isn't the bus object leak (harmful over time, but not immediately critical). The acute danger is the notifier chain: it remains registered and points into module memory that failed to initialize. When the I3C subsystem later emits bus events, the kernel attempts to dereference through this dangling function pointer. That's a guaranteed panic, not an exploitation opportunity requiring careful crafting.
This matters for how we classify kernel error-path bugs. Traditional CVSS metrics capture memory corruption well but poorly capture the reliability of trigger conditions. A module load failure is not an exotic prerequisite — it's a routine occurrence during system boot, package updates, or when dependencies aren't met. The notifier gets registered before driver registration, so any failure in that final step (device mismatch, permission issue, firmware problem) leaves the system in a crashed state on the next I3C bus event. That's a tighter blast radius than the EPSS model predicts.
The fix description is telling: 'mirror the module exit path.' This is a copy-paste error handling gap — the cleanup existed in the success path, was never duplicated for the failure path. This is a structural pattern failure, not an algorithmic one. The kernel community has repeatedly rejected scoped guards and RAII wrappers for notifier registration APIs on binary size and performance grounds, leaving the API structurally hazardous. That means similar gaps likely exist elsewhere in the I3C subsystem and adjacent drivers — this fix patches one instance of a known, accepted hazard class, not the class itself.
For defenders: treat any unpaired notifier registration in driver error paths as a high-priority finding, regardless of CVSS score. The real question is not whether this specific bug is exploitable, but whether the kernel's notifier infrastructure should be reclassified as shared fragility with non-deterministic collateral damage — a different vulnerability class entirely.