The Linux kernel did not clean up GPIOs exported through sysfs when the parent controller device was unbound. As a result, exported attributes remained under /sys/class/gpio because the kernel could not associate the descriptor with the removed device and failed to drop the final reference. This incomplete teardown can leave orphaned sysfs entries and allow the sysfs namespace to grow, potentially exhausting kernel resources or causing system instability. The weakness is a resource management flaw (CWE‑772).

All Linux kernel releases that support the legacy sysfs GPIO export interface and do not include the fix introduced by the referenced commits are affected. Vendors are not specifically cited, but the issue impacts generic Linux distributions running a kernel with the legacy GPIO sysfs path. No specific version numbers are provided, so any kernel build that lacks the recent commits is potentially vulnerable.

The CVSS score of 5.5 classifies the vulnerability as moderate severity, and the EPSS score of <1% indicates a low probability of exploitation. Based on the description, it is inferred that a local attacker would need root privileges to unbind or bind the GPIO controller device, because these operations typically require elevated permissions. The vulnerability does not allow remote code execution or other remote exploits; its impact is limited to denial of service or resource exhaustion triggered by local privilege escalation or misconfiguration. The issue is not listed in CISA's KEV catalog and appears to require a local attack vector.