The vulnerability arises in the Linux kernel unittest_data_add() function, where a failed call to of_resolve_phandles() results in an allocated memory block not being freed. The unreleased memory can accumulate over time, leading to resource exhaustion. While this defect does not allow direct code execution or privilege escalation, the prolonged use of the kernel could degrade system responsiveness or cause failures, effectively creating a denial of service condition.

Linux kernel builds that contain the faulty unittest_data_add() implementation, specifically the 6.19 release candidates rc1 through rc4 as indicated by the cpe entries. The issue may also affect other kernels that have not yet received the patch, depending on their inclusion of the same code path.

The CVSS base score of 5.5 denotes moderate severity, and an EPSS score below 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The failure occurs during a kernel path that is typically exercised when device tree bindings are resolved, which is a local scenario requiring privileged execution. Consequently, the primary risk is that a local privileged user could repeatedly trigger the problematic code path, potentially exhausting memory over time. Remote exploitation is unlikely without additional vulnerabilities.