In the Linux kernel, the rtw88 USB Wi‑Fi driver holds a reference to the USB device during probe but does not release it when probe errors occur, such as descriptor parsing failures. This results in a memory/resource leak that persists until the module is unloaded or the system is rebooted. The bug does not provide an attacker with code execution or direct confidentiality breach, but repeated leaks could weaken system stability or lead to a denial of service over an extended period.

The vulnerability affects any Linux system that uses the rtw88 driver in the kernel. This is common on systems with Wi‑Fi hardware that relies on the rtw88 module; the impact applies to all kernel releases prior to the patch that removes the redundant reference.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation observed in the field. The vulnerability is not listed in the CISA KEV catalog, reinforcing its lower priority relative to high‑profile exploits. Based on the description, the likely attack vector is a probe failure during driver initialization, which requires local/device-level interaction and is unlikely to lead to further escalation.