The Linux kernel failed to clean up GPIOs exported over sysfs when the parent controller device was unbound. Instead of releasing the final reference, the exported attributes remained listed under /sys/class/gpio. This incomplete teardown can leave dangling resources and grow the sysfs namespace, potentially exhausting kernel resources or causing system instability. The weakness identified is a resource management flaw, specifically a failure to release a reference count (CWE‑673).

All Linux kernel releases that support sysfs GPIO export but lack the fix introduced in the referenced commits. The affected systems are generic Linux distributions running a kernel that includes the legacy GPIO sysfs interface and where users might export individual pins to user space. No vendor or product names beyond the Linux kernel were listed. Specific affected‑version information is not available.

The CVSS score is not provided and EPSS is not available, so the exploitation probability is low. A local attacker would need the capability to unbind or bind the GPIO controller device, which typically requires root privileges. The vulnerability does not allow arbitrary code execution or remote exploitation; its primary impact is denial of service through resource exhaustion or orphaned sysfs entries. Because the issue persists only after a device is removed and no public exploit is known, the overall risk is moderate, with a high consequence if triggered on a heavily loaded system.