A reference leak in the Linux kernel’s MPSSE GPIO driver occurs when usb_get_dev() is called during device probe but not released on error paths. The missing usb_put_dev() causes the USB device reference to accumulate, potentially exhausting kernel references and leading to system instability or denial of service. This flaw is a kernel resource management weakness that can be categorized as a reference or memory leak.

Linux kernel versions 6.13 and 6.19 (release candidates 1 through 8) are affected. The issue exists in the gpio-mpsse driver that is compiled into these kernel releases. Users running these kernel versions with MPSSE-enabled USB devices are exposed.

The CVSS score of 5.5 indicates moderate severity. The EPSS probability is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting low likelihood of widespread exploitation. An attacker would need physical or local access to the target system to trigger the probe error path, typically by connecting a USB MPSSE device or causing a probe failure. If the bug is repeatedly exercised, it could degrade performance or crash the kernel, but remote exploitation without local access is not indicated.