The Linux kernel tpm_i2c_infineon driver contains a locality leak: if get_burstcount() returns -EBUSY on timeout, the driver exits without releasing the TPM context acquired during tpm_tis_i2c_send(). This failure to release the TPM context can leave the device in a locked state, preventing subsequent TPM operations and potentially disrupting any system service that relies on the TPM. The weakness manifests as a resource leak (CWE‑772), which may lead to service interruption for local users with TPM access.

The vulnerability affects the Linux kernel's tpm_i2c_infineon driver. No specific kernel releases are listed in the advisory, so any kernel version that includes the legacy Infineon TPM driver before the fix may be impacted. The CPE identifier associates the issue with the generic Linux kernel product.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not in the CISA KEV catalog, implying no known widespread exploitation. If a local or privileged attacker can trigger TPM operations, it could cause a denial‑of‑service condition by repeatedly invoking a get_burstcount() timeout scenario; this is inferred from the described behavior. The patch resolves the issue by adding a cleanup path to release the locality on failure, eliminating the resource leak.