A bug in the Linux kernel's slimbus core module caused a reference leak when the driver processed report‑present messages. When a new slimbus device is dynamically allocated, the kernel mistakenly retains an extra reference to the device object if it already exists, preventing the reference counter from dropping to the correct value. This over‑counting permits the kernel to keep more device objects alive than intended, which can exhaust kernel resources or cause erratic behavior such as memory pressure, degraded performance, or kernel instability.

Devices running recent releases of the Linux kernel, specifically the 6.19 release candidates (rc1 through rc6) and any kernel images derived from those, are affected because the bug resides in the upstream core slimbus driver.

The vulnerability is rated with a CVSS score of 5.5, indicating moderate severity. EPSS indicates a very low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation would require an attacker to be able to trigger report‑present messages to a target kernel with a slimbus device; this is likely limited to environments where the attacker can influence the connection of such devices to the kernel, making broad remote exploitation unlikely.