The kernel’s wbrf_record() routine allocates a temporary buffer with kcalloc() but fails to free it when acpi_evaluate_dsm() encounters an error. This defect causes kernel memory to grow without bound on repeated failures, constituting a classic memory‑leak scenario (CWE‑401).

The issue applies to Linux kernel 6.19 release‑candidate builds from rc1 through rc6. Any kernel that includes the legacy wbrf_record() implementation in that series is vulnerable until the patch that frees the buffer on failure is applied. The CVE does not state whether later stable releases contain the fix, so users cannot assume that simply running a newer kernel automatically resolves the issue.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. The risk manifests when acpi_evaluate_dsm() repeatedly fails, allowing an attacker or system instability to drain kernel memory and potentially degrade performance or availability. No explicit exploitation path or privilege level is provided in the CVE description, so the threat is limited to the memory‑leak effect itself.