In the Linux kernel, the function gpi_peripheral_config() in the qcom GPI DMA engine driver contains a memory leak that occurs when a reallocation fails. The function overwrites the original configuration pointer with NULL, causing the previously allocated memory to become unreachable and unrecoverable. This flaw can gradually increase kernel memory usage and eventually destabilize the system, resulting in a denial‑of‑service scenario if the leak is triggered repeatedly. The weakness is a classic unbounded memory leak (CWE‑401).

The vulnerability exists in all Linux kernel builds that include the affected driver code, specifically kernels 5.11 through 6.19 (including all release candidates) and any future releases that have not yet integrated the fix. As the product is part of the Linux kernel itself, any distribution using these kernel versions without the patch is impacted.

The CVSS score is 5.5, indicating a moderate severity. The EPSS score is less than 1%, reflecting a very low probability of exploitation in the current environment, and the vulnerability is not listed in the CISA KEV catalog. The description does not specify a remote attack vector; it is inferred that the exploit requires local access to influence driver configuration operations, such as repeated peripheral initializations or injection of allocation failures. If an attacker can trigger sufficient allocations and failures, they could force continuous memory growth, eventually leading to kernel crash or service disruption.