The Linux kernel flaw arises from omitting a reference decrement when parsing GPIO device tree entries in pcs_add_gpio_func. Each call to of_parse_phandle_with_args() returns a device_node pointer with its reference count incremented, but the code never releases that reference. Over time, these unreleased references accumulate, leading to a gradual increase in device node reference counts. If the leaks persist, kernel memory consumption can grow and device node handling may become unreliable, potentially resulting in kernel instability or denial‑of‑service conditions.

All Linux kernel versions released before the fix commit are affected. The issue surfaces on any system that loads device tree nodes parsed by pcs_add_gpio_func, which encompasses a wide range of embedded devices, servers, and other platforms that rely on the pinctrl subsystem for pin and GPIO configuration.

The EPSS score of < 1% indicates a very low probability of exploitation. Coupled with a CVSS score of 5.5, the vulnerability is considered moderate in severity but unlikely to be targeted. It is not listed in CISA's KEV catalog, and no public exploits are known. The likely attack vector is local, requiring an attacker to influence the kernel's device tree parsing—perhaps by installing malicious firmware with crafted phandle entries or by executing privileged code on the host. Given the low exploitation probability and moderate impact, the risk is low to moderate, but the potential for resource exhaustion warrants timely remediation.