The vulnerability in the Linux kernel's hwmon driver for the nct7363 chipset causes a reference count leak when parsing device tree phandles. Each call to of_parse_phandle_with_args allocates a reference to a device node that is never released because of_node_put is omitted. Over time, repeated calls could exhaust kernel memory and driver resources, potentially leading to kernel instability or a denial of service. This issue falls under a resource exhaustion weakness, similar to CWE-401.

Affected systems are any Linux distributions running a kernel that includes the nct7363 driver, as identified in the CPE string for the Linux kernel generic product. This includes all current Linux kernel releases that have not yet incorporated the fix, regardless of vendor distribution. Specific affected kernel versions are not listed, so any kernel lacking the upstream commit that fixes the leak is vulnerable.

The CVSS score is not provided, but the EPSS score is unavailable and the vulnerability is not in CISA's KEV catalog. The vulnerability is a local kernel flaw that typically requires a process with elevated privileges or local access to trigger. An attacker with local access could repeatedly invoke the fan control path to drain resources. While not exploitable remotely, the potential for denial of service makes it a high‑priority issue for environments that rely on real‑time or mission‑critical Linux systems.