The vulnerability involves improper deallocation in the Toshiba HAPS module of the Linux kernel. If toshiba_haps_add() fails after allocating its haps object, the allocation is not freed, creating a leak. When toshiba_haps_remove() clears the pointer before freeing the object, that memory also becomes unreachable. These leaks accumulate over time, consuming kernel memory and can lead to a degradation of system performance or even a kernel out‑of‑memory condition, which may result in a denial‑of‑service. The weakness aligns with CWE‑401.

Affected systems are Linux kernel instances that compile the x86 platform Toshiba HAPS driver. Any kernel version that includes the buggy implementation of toshiba_haps_add and toshiba_haps_remove is susceptible, regardless of distribution; the exact affected releases are not enumerated in the advisory.

Risk is low exploitation probability: the EPSS score is below 1% and the vulnerability is not listed in CISA KEV. The bug is local, requiring access to the kernel to trigger the faulty routines, and there are no known remote exploits. The primary threat is accidental resource exhaustion as the bug is not user‑controllable, but a prolonged leak could lead to a denial‑of‑service scenario if the kernel runs out of memory.