In kernel source thermal_of_cm_lookup(), a device node returned by of_parse_phandle() is never released, creating a reference leak that can progressively increase kernel memory usage until the system exhausts critical resources. The flaw represents a reference leak weakness (CWE-772).

Any Linux kernel version built before the remediation commit 025796c is affected. Distributions that have not incorporated this patch into their kernel packages remain vulnerable. Updating to a kernel release that includes the __free(device_node) cleanup attribute resolves the issue.

The CVSS score is 5.5, indicating moderate severity. The description does not disclose an active exploitation vector or known exploitation instances. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly reported exploits. The primary risk is a potential denial of service through uncontrolled kernel memory growth if the kernel repeatedly executes thermal_of_cm_lookup(), though no specific attacker model is provided in the advisory.