The Linux kernel tpm_i2c_infineon driver contains a locality leak: if get_burstcount() returns -EBUSY on timeout, the driver exits without releasing the locality acquired during tpm_tis_i2c_send(). This failure to release the TPM context can leave the device in a locked state, preventing subsequent TPM operations and potentially disrupting any system service that relies on the TPM. The weakness manifests as a resource leak (CWE‑400), which may lead to service interruption for local users with TPM access.

The vulnerability affects the Linux kernel's tpm_i2c_infineon driver. No specific kernel releases are listed in the advisory, so any kernel version that includes the legacy Infineon TPM driver before the fix may be impacted. The CPE identifier associates the issue with the generic Linux kernel product.

There is currently no published exploitation evidence and the EPSS score is not available; consequently, the likelihood of exploitation is uncertain but potentially low to moderate. The vulnerability is not present in the CISA KEV catalog, indicating no known widespread exploitation. Nevertheless, a local or privileged attacker who can trigger TPM operations could cause a denial‑of‑service condition by repeatedly invoking a get_burstcount() timeout scenario. The patch resolves the issue by adding a cleanup path to release the locality on failure, eliminating the resource leak.