A flaw in the Linux kernel’s GPIO subsystem causes the reference count on a device structure to remain unreleased when the gpiochip_add_data_with_key() function encounters an error. This mismanagement can lead to a resource leak or, in the worst case, a double free that corrupts kernel memory. The vulnerability does not provide a direct remote code execution path; it would require an attacker to be able to trigger the specific error handling path within the kernel, implying a local privilege escalation or root context is necessary for exploitation.

The issue affects Linux kernel builds that omit the commit aab5c6f20023 which introduced proper release handling. Because the affected versions are not enumerated in the CVE payload, systems running any kernel that predates this commit are potentially at risk. Distributions that provide a patched kernel, even if the exact release is not specified, are considered protected.

The CVSS score is 5.5, and the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so quantitative risk estimates cannot be specified. Nonetheless, a double free in kernel code can trigger a panic or allow an attacker with sufficient privileges to alter kernel memory, so the risk is non‑negligible for affected systems. The lack of a publicly documented exploit reduces the current threat level, but the kernel crash potential warrants timely remediation.